System and Network Defence
This article centers on the management of cybersecurity operations, encompassing activities such as designing, building, operating, and continuously enhancing an organization’s overall security capacity. The initial line of defense revolves around ensuring the physical security of network equipment. In parallel, there exist dedicated application security measures designed to safeguard software integrity. It’s crucial to acknowledge that network services and protocols carry their own set of vulnerabilities, necessitating specific protective measures tailored to their unique characteristics.
One effective strategy is network segmentation, which involves creating Virtual LANs (VLANS) to bolster network resilience. To enhance the security of your users’ wireless and mobile connections, it is advisable to implement one of the WPA standards. Moreover, numerous tools are available to fortify cybersecurity resilience within network design.
Furthermore, as a cybersecurity technician, it is imperative to recognize the interconnected nature of various devices, including medical equipment, automobiles, and drones.
These devices are susceptible to potential cyber threats and must be diligently shielded. Thus, it becomes paramount for every organization to establish multiple layers of security mechanisms and controls, enabling a proactive response to cybersecurity threats. This article will provide insights into the effective management and monitoring of these security layers to identify risks and safeguard against cyberattacks.
Physical Security
Physical Security is the first element of network security. It is the set of measures and safeguards put in place to protect the physical components and infrastructure of a computer network from unauthorized access, damage, theft, or any other physical threats. It involves implementing security controls and practices to ensure the physical integrity and confidentiality of network resources and data. Physical network security measures can include the use of access control systems, surveillance cameras, locks, keycards, biometric authentication, secure facility design, and other physical barriers to prevent unauthorized individuals from physically accessing network equipment, servers, data centers, and other critical network assets. The primary goal of physical network security is to mitigate risks and vulnerabilities associated with physical threats and to maintain the availability and reliability of network services.
Application Security
Application security, often abbreviated as “AppSec,” refers to the practice of safeguarding software applications and systems from security threats and vulnerabilities. It involves the implementation of protective measures and best practices throughout the software development lifecycle to prevent unauthorized access, data breaches, and malicious attacks. These measures include code reviews, penetration testing, encryption, authentication, and authorization mechanisms. The goal of application security is to ensure that software applications are robust, resilient, and resistant to exploitation, thus safeguarding sensitive data and preserving the integrity of the application and the user’s trust. Effective AppSec is essential in today’s digital landscape to counter evolving cyber threats.
Application Development
In order to uphold security throughout all phases of application development, it is crucial to adhere to a strong and comprehensive process. The development phases are following:
Developing and testing
Software undergoes its development and updates within a dedicated development environment, providing a controlled space for coding, testing, and debugging before deployment. This development environment is intentionally less restrictive and features lower security measures compared to the live environment. To keep track of alterations in the software code, version control software is employed, ensuring organized management of changes. Developers may also utilize a sandbox environment to prevent unintentional code overwrites while in the development phase.
During the testing phase, developers assess how the code interacts within the standard operating environment. Quality assurance (QA) actively identifies and reports any software defects. Addressing defects at this stage is considerably more efficient and less complex.
Staging and production
Staging environments should closely resemble the production environment used by the organization. By conducting tests within a staging environment, developers can ensure that the software operates within the specified security parameters. Once the developer has successfully tested the program’s security features, it can then be deployed into the production environment.
Provisioning and deprovisioning
Provisioning involves either creating or updating software, while deprovisioning entails its removal.
An organization can streamline software provisioning and deprovisioning by implementing a self-service portal for automation.
Security Coding Techniques
While coding applications, developers employ various methods to ensure that they have fulfilled all security prerequisites
Normalization
Normalization is a technique employed to structure data within a database, with the aim of preserving data integrity. It simplifies an input string to its most basic recognized form, ensuring that all strings possess distinct binary representations and enabling the detection of any potentially malicious input
Stored Procedure
A stored procedure comprises precompiled SQL statements stored within a database, designed to perform specific tasks. When employing a stored procedure to handle input parameters from clients with varying data inputs, you can minimize network traffic and achieve quicker results
Obfuscation and Camouflage
Developers can employ obfuscation and camouflage techniques to deter the reverse engineering of software. Obfuscation involves concealing genuine data with random characters or other data, while camouflage substitutes sensitive information with realistic yet fictitious data
Code Reuse
Code reuse involves the utilization of pre-existing software to construct new applications, resulting in time and cost savings in development. However, it’s essential to exercise caution to prevent the introduction of potential vulnerabilities.
SDKs
Third-party libraries and Software Development Kits (SDKs) serve as valuable sources of code that expedite and economize application development. However, it’s important to note that vulnerabilities within these SDKs or third-party libraries have the potential to impact numerous applications.
Input Validation
Effective control over the data input process is essential for upholding the integrity of a database. Databases frequently face attacks aimed at injecting malformed data, potentially leading to issues such as application confusion, crashes, or unintended disclosure of sensitive information to attackers. Below, you’ll find an example illustrating this scenario—an automated input attack.
In this scenario, customers utilize a web application form to subscribe to a newsletter. An automated database application promptly generates and dispatches email confirmations to these customers. However, attackers manipulate the URL links contained in these emails. These alterations can result in changes to customer usernames, email addresses, or subscription statuses when they click to confirm their subscription. Consequently, when the email returns to the host server, it receives inaccurate information, which may go unnoticed unless each email address is cross-checked against the subscription data.
Hackers can mechanize this attack, inundating the web application with a multitude of invalid subscribers in an attempt to compromise the newsletter database.
Validation Rules
A validation rule verifies that data aligns with the guidelines set by the database designer. It plays a crucial role in guaranteeing the thoroughness, correctness, and uniformity of data. The criteria considered within a validation rule encompass:
- Size – verifies the character count in a data entry.
- Format – ensures data adheres to a designated format.
- Consistency – checks for code uniformity among interconnected data elements.
- Range – confirms that data falls within a specified minimum and maximum range.
- Check digit – includes an additional calculation for generating a check digit, enhancing error detection.
Integrity Checks
Data breaches pose a risk to the security of your devices and systems.
To safeguard data integrity, an integrity check assesses the consistency of information within a file, image, or record, ensuring it remains unaltered. This process employs a hash function to capture a data snapshot, subsequently verifying that the data remains unchanged. An example of such a hash function is a checksum.
How a checksum works
A checksum serves as a means to validate the integrity of files or strings of characters both before and after they are transferred between devices, whether it’s across a local network or the Internet. Checksums essentially convert each piece of data into a value and then calculate a total. When assessing data integrity, the receiving system replicates this process. If the two totals match, it signifies that the data is intact. Conversely, if they don’t match, it indicates that a modification has occurred somewhere during the transfer.
Hash Functions
Popular hash functions encompass MD5, SHA-1, SHA-256, and SHA-512. These employ intricate mathematical algorithms to evaluate data against a hashed value. For instance, once a file is downloaded, users can validate its integrity by comparing the hash values generated by a hash calculator with those provided by the source.
Version Control
Organizations employ version control to prevent unintended alterations by authorized users. Version control ensures that two users cannot simultaneously modify the same item, be it a file, database record, or transaction. To illustrate, when the first user opens a document, they have the authority to make changes. Meanwhile, if another individual attempts to access the document while the first user is editing it, they will only be able to view a read-only version
Backups
Reliable backups play a crucial role in preserving data integrity in case of data corruption. It’s essential for an organization to validate its backup procedures to guarantee the integrity of these backups.
Authorization
Authorization dictates access to an organization’s resources, following a ‘need-to-know’ principle. For instance, through file permissions and user access controls, only specific users with a legitimate reason can alter data. An administrator has the ability to designate a file as ‘read-only,’ meaning that any user trying to access it won’t be able to make any modifications.
Other Application Security Practices
How can you ensure the authenticity of software you’re installing or the security of your information while browsing the Internet?
Code Signing
Code signing serves as evidence that a software program is genuine.
Executable files created for installation and use on a device undergo digital signing, which confirms the identity of the author and guarantees that the software code remains unaltered since its signing.
Secure Cookies
Utilizing secure cookies safeguards the data stored in them from potential hackers.
When your client system communicates with a server, the server sends an HTTP response that directs your browser to generate one or more cookies. These cookies retain data for future requests while you navigate the website.
Web developers should employ cookies alongside HTTPS to enhance their security, ensuring that cookies are not transmitted via unencrypted HTTP.
Managing Threats to Applications
Organizations have the capability to put in place multiple strategies for handling risks within the application domain. They can get following measures
Unauthorized Access to Sever/System Room/Data Centers
Sever and System Up and Down Time
Network Operating System Vulnerability
Unauthorized Access of operating system
Data Loss
Software Development Vulnerabilities
