Chap 2.

Vulnerabilities and Access

Control
Cyber Security Vulnerabilities-Overview:

• These hackers can enter the networks without authorization.

• Examples of Cyber Security Vulnerabilities :
• Missing data encryption
• Lack of security cameras
• Unrestricted upload of dangerous files
• Code downloads without integrity checks
• Weak and unchanged passwords
Causes of Cyber Security Vulnerabilities

• There are many causes of cyber security vulnerabilities. :

• Complexity:
• Familiarity:
• Connectivity:
• Poor Password Management:
• Internet:
• Software Bugs:
 TYPES OF CYBER
[Link]
• Types of Cyber Security Vulnerabilities
• Here are a few common types of cybersecurity vulnerabilities

1] System Misconfigurations :
• Network assets can cause system mistakes with incompatible security
settings or Out-of-date

2] Unpatched Software :
• Attackers may use these unpatched vulnerabilities to create threat in
confidential data
3] Missing or Weak Authorization Credentials
• Attackers frequently utilize brute force methods, such as guessing
employee passwords, to gain access to systems and networks.
4] Malicious Insider Threats
• Insider threats can be make challenging task to identify [Link]
Consider purchasing network access control tools is to counting these
risks.
5] Missing or Poor Data Encryption
• If a network has weak, it will be simpler for attackers to intercept system.
6] Zero-day Vulnerabilities
• Since the vulnerability has not yet been identified or reported by the
system
7] Lack of Encryption
Without encrypted data.
Vulnerabilities in Software &
System Administration
• What is a Software Vulnerability?
• A software vulnerability is a defect in software that could allow an
attacker to gain control of a system.
• Weaknesses present in software programs, operating systems,
firmware, and applications.
• Causes:
• Broken access control
• Cryptographic failure
• Secure design pattern
 Types of Software Vulnerability:
• 1] Buffer Overflow
• 2] SQL Injection
• 3] Cross-Site Scripting
• 4] Broken Authentication
• 5] Command Injection
• 6] Missing Access Controls
• 7] Cryptographic Failures
• How are Vulnerabilities Discovered ?
• There are several techniques used to identify vulnerabilities in software:
• Vulnerability Scanning:
• Penetration Testing:
• Fuzz Testing:
• Code Review:
• Risk Assessments:
• User/Admin Reports:
• Vendor Advisories:
 How Can Software Vulnerabilities Be Prevented and Mitigated?

1] Secure SDLC:
• 2] Developer Training:
• 3] Input Validation:
• 4] Patch Management:
• 5] Segmentation.
• 6] Monitoring:
• 7] Risk Assessments:
 Vulnerability in System
Administration
• Definition :
• It is a weakness in a computer system that can be exploited by
cybercriminals.

• System administration functions :

• Installation,
• configuration
• and maintenance,
• network equipment
Duties of System Admin.
Types of system administrator

• Windows Systems Administrator

• Business Systems Administrator
• Security Systems Administrator
• Office 365 Systems Administrator
• Google Workspace Admin
Skills you need as a system administrator

• As a system administrator, you’ll need to develop a core set of skills

that will allow you to conduct function smoothly.

• In-depth knowledge of operating systems:

• Familiarity with hardware:
• Cloud computing skills:
• Knowledge of networks:
• Communication and interpersonal skills:
 Complex Network Architecture
• Network architecture refers to the design and structure of a computer
network —
• The main components of a network architecture include the following:
• Network topology:
• The client:
• Routers:
• Switches:
• Protocols:
• Transmission media:
 Network architecture types

• 1]Peer-to-peer networks
• 2] Client-server architecture
• 3] Hybrid network architecture
• 4] Cloud-based architecture
• 5] Flat/two-tier network architecture
• 6] Three-tier network architecture
Network architecture designs

• Flat/two-tier network architecture

• The two-tier architecture design consists of two layers — the access layer
and the distribution layer.
• Three-tier network architecture
• A three-tier network architecture organizes your network into three layers.
• The access layer comes at the bottom. It connects user devices like
workstations and printers to the network.
• The distribution layer comes above the access layer. It separates work
groups, like sales and HR.
• At the top, you have the core layer. It acts as backbone and quickly
transfers data.
OSI MODEL
• Physical Layer (Layer 1)
• The physical layer converts and transmits raw bit stream data (1s and 0s) over
the physical medium.
• Wireless frequency links, like Wi-Fi and wireless network connections
• Network cabling,Light-speed transmission, such as fiber-optic cabling
• Data Link Layer (Layer 2)
• The data link layer defines the format of data on the network. Like the
network layer, the data link layer enables data transfer between two directly
connected nodes.
• It also uses logical link control (LLC) to provide flow control and error control.
• Network Layer (Layer 3)
• It’s responsible for breaking up transport layer segments into smaller
network packets for transmission
• Transport Layer (Layer 4)
• The transport layer uses transmission protocols including
Transmission Control Protocol (TCP) and User Datagram Protocol
(UDP), to manage network traffic between systems to ensure correct
data transfers.
• Session Layer (Layer 5)
• The session layer creates and maintains the sessions (connections)
that two systems need in order to speak to each other. Layer 5
defines…:
• When sessions are created and opened
• Presentation Layer (Layer 6)
• The presentation layer ensures the data is prepared in a usable form for the
application layer (receiving side) or for the network layer (sending side). Layer 6 is
responsible for:
• Data translation
• Encryption & decryption
• Compression
• Other data preparation items
• Application Layer (Layer 7)
• The application layer is the closest layer to the end user. It receives information from
the end user and sends results back to the user. Despite its name, Layer 7 is not
where client applications live. This layer provides the protocols that allow
software/apps to transmit data, including:
• HTTP and HTTPS,FTP,POP,SNMP.
 # Open Access to Organizational
Data
• Open Access to Organizational Data:

Open access to organizational data refers to the practice of providing

unrestricted access to information within an organization.
• Components of Open Access to Organizational Data:

1] Data Repositories:
2] Access Control Mechanisms
3] Collaboration Platforms
Authentication :
• Authentication is the process of verifying a user or device before
allowing access to a system or resources.
• Authentication is part of a three-step process for gaining access to
digital resources:
• Identification—Who are you?
• Authentication—Prove it.
• Authorization—Do you have permission?
 Types of Authentication

1] Single-Factor Authentication :
• one-factor authentication involves matching one credential to gain access to a system
• (i.e., a username and a password)
• 2] Two-Factor Authentication :
• 2FA requires two factors of authentication out of the three categories:
• Something you know (i.e., username and password)
• Something you have (e.g., a security token)
• Something you are (e.g., TouchID or other biometric credentials)
• 3] Three-Factor Authentication
• Three-factor authentication (3FA) requires identity-confirming credentials from three
separate authentication factors (i.e., one from something you know, one from
• Multi-Factor Authentication :
• Multi-factor authentication (MFA) refers to any process that requires
two or more factors of authentication.
• Single Sign-On Authentication
• Single sign-on (SSO) authentication allows users to log in and access
multiple accounts
• One-Time Password
• A one-time password (OTP) or one-time PIN (sometimes called a
dynamic password)
• 3. Financial Loss:
Can lead to financial loss, particularly in cases where attackers gain access to
financial systems or financial data.
• 4. Reputation Damage:
• Weak authentication can damage an organization's reputation.
• Solutions for Improving Authentication Security
• 1. Multi-Factor Authentication:
• Multi-factor authentication (MFA) requires users to provide two or more
forms of authentication before being granted access to a system
• 2. Password Policies:
• Organizations should implement strong password policies that require users
to create complex passwords and change them regularly.
Access control, Audit :
• What is access control?
• Access control is a fundamental component of data security that
dictates who’s allowed to access and use company information and
resources.
• How does access control work?
• Many access control systems also include multifactor authentication
(MFA)

[Link]
• The four access control models are:
• Discretionary access control (DAC):
• administrator of the protected system, data, or resource sets the
policies for who is allowed access.
• Mandatory access control (MAC):
• This model is common in government and military environments.
• Role-based access control (RBAC):
• This widely used method is based on a complex combination of role
assignments, authorizations, and permissions.
• Attribute-based access control (ABAC):
access is based on a set of attributes and environmental conditions, such
as time of day and location.
Audit :
• A cybersecurity audit involves a comprehensive analysis and review of your IT
infrastructure.

An audit performs helps organizations to:

• 1] Identify and remediate cybersecurity risks

• 2] Fulfill internal and external compliance requirements.

• 3] Applicable to laws and regulations

• 4] Improve credibility with customers/partners

• The following three steps outline best practices for performing a
thorough cybersecurity audit.

• 1. Determine Scope -
2. Identify Threats
3. Plan Response
Intrusion Detection System :
• An intrusion detection system (IDS) is a network security tool that
monitors network traffic and devices for known malicious activity,
suspicious activity.

• An IDS can help accelerate and automate network threat detection by

alerting security administrators to known or potential threats.

A centralized security tool such as a security information and event

management (SIEM) system can combine data.
Types of intrusion prevention
systems :
• IDSs are categorized as ----
• Network intrusion detection systems (NIDSs)
• monitor inbound and outbound traffic to devices across the network.
NIDS are placed at strategic points in the network.

• Host intrusion detection systems (HIDSs)

• are installed on a specific endpoint, like a laptop, router, or server. The
HIDS only monitors activity on that device.
• An application protocol-based IDS (APIDS)
• works at the application layer, monitoring application-specific
protocols. An APIDS is often deployed between a web server and an
SQL database to detect SQL injections.
•
• It consists of following blocks:
• Log File:
• Packet sniffer Win Dump collects packet headers of data coming from internet or LAN. This file
is called as log file.
• Data Formatting Unit:
• Data collected in log file is classified according to various fields in the packet header.
• Log Database:
• It contains different tables according to different protocols (like TCP/IP, UDP, ICMP, and ARP).
For each protocol there is one table.
• Each table consists of attributes related to that particular protocol.
• Misuse Detection Block:
• Misuse Detection technique is used for detection of known attacks. Many computer attacks
have fix signature.
• Attack Database:
• Attack database also contains tables for different protocols as in case of log database.
• The entries from log database which are declared as attacks are stored in attack database.
Threat Management
• Threat management refers to the process of identifying, assessing, and
mitigating threats to an organization's information assets, including hardware,
software, data, and networks.
• The goal of threat management is to minimize the impact of threats.
• The threat management process typically involves several steps, including:
• 1. Risk assessment:
• Identifying potential threats and vulnerabilities to an organization's information
asset.
• 2. Threat identification:
• Determining severity of potential threats to an organization's information
assets.
• 3. Threat mitigation:
• Implementing security measures to prevent and respond to potential threats,
including firewalls, intrusion detection systems, antivirus software, and access
controls.
• [Link] response:
• Establishing a plan for responding to security incidents and recovering
from them, including backup and recovery procedures
• incident reporting, and incident analysis.
• 5. Continuous monitoring:
• Regularly monitoring an organization's information assets.
•Thank you