220-1102 Security

Security Detailed Explanation

2.1 Network Security

Firewalls

• What is a Firewall?

  • A firewall acts as a barrier between your device or network and external threats. It monitors and controls incoming and outgoing network traffic based on predefined security rules.

• Types of Firewalls:

  1. Hardware Firewalls:
     • Standalone devices designed to protect an entire network.
     • Found in routers or dedicated firewall appliances.
     • Example: Firewalls built into enterprise-grade routers.
  2. Software Firewalls:
     • Installed on individual devices, such as laptops or desktops.
     • Example: Windows Defender Firewall.

• Configuring Rules:

  • Inbound Rules: Determine what types of traffic are allowed to enter your device or network.
  • Outbound Rules: Control what traffic is allowed to leave your device or network.
  • Example: Allow only specific applications, like browsers, to access the internet.

Wireless Security

• Encryption Protocols:

  • WPA2 (Wi-Fi Protected Access 2): Secure and widely used encryption standard for wireless networks.
  • WPA3: An updated version of WPA2 with stronger encryption and better protection against brute-force attacks.

• Security Measures:

  • Hiding SSID: Prevents your network name from being broadcasted. Though not foolproof, it adds an extra layer of security.
  • MAC Address Filtering: Allows only specific devices with pre-approved MAC addresses to connect to your network.

Virtual Private Network (VPN)

• What is a VPN?

  • A VPN creates a secure and encrypted connection between your device and a remote server, protecting your data from being intercepted.

• Types of VPN Protocols:

  1. PPTP (Point-to-Point Tunneling Protocol): An older protocol with basic encryption, not very secure.
  2. L2TP/IPsec (Layer 2 Tunneling Protocol with IP Security): Provides strong encryption and is widely used.
  3. OpenVPN: A popular open-source protocol offering robust security and flexibility.

2.2 Authentication and Access Control

User Management

• Local Accounts:

  • Created and managed on individual devices.
  • Example: A standard Windows user account on a home computer.

• Domain Accounts:

  • Managed by a centralized server, often used in corporate environments.
  • Allows users to log into any device within the domain using the same credentials.

• Multi-Factor Authentication (MFA):

  • Adds an extra layer of security by requiring two or more forms of verification:
    1. Something you know (password).
    2. Something you have (phone or security token).
    3. Something you are (fingerprint or facial recognition).

Access Permissions

• File and Folder Permissions:

  • Control who can read, write, or execute files and directories.
  • Example:
    • Read: View the file but not modify it.
    • Write: Modify or delete the file.
    • Execute: Run a program or script.

• Group Permissions:

  • Manage access for multiple users by assigning permissions to a group instead of individual accounts.
  • Example: An “HR” group might have access to payroll files.

• User Account Control (UAC):

  • A Windows feature that prevents unauthorized changes by prompting for administrator permission when needed.

2.3 Data Security

Encryption Techniques

• Disk Encryption:

  • Protects data stored on a device by encrypting the entire drive.
  • Examples:
    • BitLocker: Built into Windows, used for full-disk encryption.
    • Veracrypt: A free, open-source encryption tool.

• Data Encryption During Transmission:

  • Protects data sent over the internet.
  • Examples:
    • TLS (Transport Layer Security): Encrypts data between web browsers and servers.
    • SSL (Secure Sockets Layer): An older protocol replaced by TLS.

Data Backup

• Types of Backups:

  1. Full Backup: Copies all data. Requires more time and storage but simplifies recovery.
  2. Differential Backup: Copies only the data changed since the last full backup. Faster than a full backup.
  3. Incremental Backup: Copies only the data changed since the last backup of any type. Requires less storage but longer recovery time.

• Backup Tools:

  • Windows Backup: Built-in tool for scheduling backups.
  • Third-Party Tools: Software like Acronis or Backblaze for more advanced backup options.

2.4 Security Threats

Malware Types

1. Viruses:
   • Attach to files and spread when the file is executed.
   • Often cause damage or slow down systems.
2. Worms:
   • Self-replicating and spread without user intervention.
3. Spyware:
   • Secretly collects user information.
4. Adware:
   • Displays unwanted advertisements and may slow down systems.
5. Ransomware:
   • Locks access to files and demands payment for unlocking them.

Social Engineering Attacks

• Phishing:
  • Attackers pose as legitimate entities to trick users into sharing sensitive information, like passwords or credit card numbers.
• Impersonation:
  • Pretending to be someone trustworthy (e.g., IT support) to gain access to resources.

Network Attacks

• DDoS (Distributed Denial of Service):
  • Overwhelms a server with excessive traffic, making it unavailable to legitimate users.
• Zero-Day Vulnerabilities:
  • Exploiting unknown security flaws in software before they can be patched.

2.5 Best Practices for Security

1. Regular Patch Updates:

   • Keep operating systems, applications, and firmware up-to-date to fix vulnerabilities.

2. Installing and Using Antivirus Software:

   • Protects against malware by scanning and removing threats.

3. Configuring Account Lockout Policies:

   • Locks a user account after a set number of failed login attempts to prevent brute-force attacks.

Final Thoughts

This section focuses on securing systems and data. As a beginner, start by learning to configure a firewall, set up a VPN, and understand how permissions work. Regularly practice identifying and responding to threats in a safe, controlled environment to build confidence and expertise.

Security (Additional Content)

1. Network Security: Port Control and Default Deny Principle

Port-Based Filtering

• Network firewalls and host-based firewalls can allow or block traffic based on port numbers.

• Example:

  • Allow TCP 80 (HTTP) and TCP 443 (HTTPS) for web browsing.

  • Block all other unnecessary ports like TCP 21 (FTP) or UDP 137–139 (NetBIOS) to reduce risk.

Default Deny Policy

• This security model blocks all traffic by default, and only allows explicitly permitted connections.

• Often described as "deny all unless permitted".

• Used in high-security environments (e.g., financial systems, healthcare).

• Must be carefully managed to avoid accidentally blocking legitimate services.

Exam Tip: Know that most firewalls can work on an "allow list" model and that a "default deny" strategy is considered more secure than "default allow".

2. Authentication and Access Control

Permission Inheritance

• In systems like Windows NTFS, child objects inherit permissions from parent folders.

• Inherited permissions flow automatically unless explicitly overridden.

Common Use Case:

• Admins may disable inheritance for a sensitive subfolder to apply custom access rules.

Note: Overriding inherited permissions can introduce complexity, so documentation is important.

Windows Account Types Overview

• Administrator Account:

  • Full system control.

  • Can install/remove software, manage user accounts, and modify system settings.

• Standard User:

  • Can run applications and modify their own settings.

  • Requires admin credentials to install software or make system changes.

• Guest Account:

  • Very limited access.

  • Typically used for temporary logins.

  • Disabled by default in most recent Windows versions due to security concerns.

3. Data Security: Offsite and Cloud Backups

Offsite Backup

• Refers to storing data in a physically separate location to protect against local disasters.

• Often used in combination with on-site backups.

Cloud Backup

• Uses online services to back up files automatically.

• Provides:

  • Redundancy

  • Version control

  • Remote access

• Examples: Google Drive, OneDrive, iCloud, Dropbox, Backblaze.

Security Consideration:

• Cloud backups should be encrypted both in transit and at rest.

• Multi-factor authentication (MFA) should be used for account access.

4. Security Threats: Additional Threat Types

Rootkits

• A type of stealth malware that hides its existence while granting privileged access.

• Difficult to detect with standard antivirus software because it loads before the OS or masks its processes.

Detection/Removal:

• Specialized rootkit scanners or full system reinstall may be required.

Keyloggers

• Software or hardware that records keystrokes to capture login credentials, financial information, or other sensitive data.

• Often delivered via phishing emails, drive-by downloads, or trojanized apps.

Detection:

• Anti-malware tools, behavior analysis, or endpoint monitoring software.

Email Spoofing

• Involves forging the sender address of an email to make it appear as if it came from a trusted source.

• Common in phishing and social engineering attacks.

Indicators of Spoofing:

• Unusual sender address or domain

• Mismatched headers (e.g., “From” and “Reply-To” don’t match)

• Suspicious grammar or urgency

Preventive Tools:

• SPF, DKIM, and DMARC records for domain validation

• Email filtering and anti-spam software

5. Best Practices for Security

Principle of Least Privilege

• Definition: Users and applications should have only the minimum access rights required to perform their tasks.

• Helps reduce the attack surface and limit damage from compromised accounts.

Examples:

• HR staff should not have admin rights on their PCs.

• A software app should not run with root/administrator access unless necessary.

Disabling Unnecessary Services and Ports

• Unused network features and services should be disabled or removed to reduce vulnerabilities.

• Examples:

  • Disable SMBv1, which is outdated and vulnerable.

  • Turn off file and printer sharing if not needed.

  • Close open ports using firewall rules or service settings.

Regular audits and vulnerability scans help identify unneeded services and ensure proper configuration.