Saturday, September 15, 2018

SSCP 2018 Exam Changes



With effect from 1st November 2018, (ISC)2 would be doing a domain refresh in the course content of SSCP certification. This is in line with a refresh cycle of 3 years for every certification which (ISC)2 offers.

In this post, we look at changes which will take place in this refresh. We will look at it from a perspective of what will remain the same for an exam giver and what would change.

Question 1. Have the domains changed completely?

No, the weight of the domains has changed. There are minor changes. So if “Security Operations & Administration” had a weight of 17% in the earlier exam (2015), it has been reduced to 15% in the new exam outline.

Question 2. Would the changes affect my already bought course material?

No, the course content broadly remains the same. The course content does not change. Your old books or exam material will remain fully valid. 

Question 3. Is there a change in the exam format too just like CISSP?

Absolutely No. The format remains the same. You will have 125 questions to answer in 3 hours where 100 questions will be graded. 25 questions are research questions, however, from an examination point of view, you’ll not be able to differentiate amongst them. There is no negative marking, hence you must attempt all the questions. You need to secure 700 out of 1000 points to clear the exam.

Question 4. Where can I identify the changes that have been brought in topic wise with respect to various domains?

Here are the exam outlines for your reference: 



Domain Wise Changes are also mentioned here for your assistance:

Domain 1 Access Controls
New Additions:
Federated Access, IAM systems, Subject-based & Object-Based Access Controls.

Domain 2 Security Operations and Administration
New Additions:
Software inventory and licensing, Data Storage, Periodic audit review.

Domain 3 Risk Identification, Monitoring, and Analysis
New Additions:
Risk management frameworks (e.g., ISO, NIST), Remediation validation, Audit finding remediation, Legal and regulatory concerns (e.g., jurisdiction, limitations, privacy).

Domain 4 Incident Response and Recovery
New Additions:
Support incident lifecycle (Preparation, Detection, analysis, and escalation, Containment, Eradication, Recovery, Lessons learned/implementation of new countermeasure)

Domain 5 Cryptography
New Additions:
Web of Trust (WOT) (e.g., PGP, GPG) 
Note – In this domain, some restructuring has taken place. Although the new exam outline shows some topics, they were also present in the older CBK too.

Domain 6 Network and Communications Security
New Additions:
Transmission media types (e.g., fiber, wired, wireless), Network relationships (e.g., peer to peer, client-server), Wireless security devices (e.g., WIPS, WIDS), Bluetooth, 

Domain 7  Systems and Application Security
Removed: Secure Big Data Systems (Application vulnerabilities, Architecture or design vulnerabilities)

Question 5. Has the cost of the exam changed?

No, the cost of the exam remains the same. You need to pay 250USD or equivalent and book the exam through the Pearson Vue Centre only.

Question 6. When will these changes go into effect?

All changes will reflect from 1st November 2018. 

Question  7. Do these updates affect the experience requirement for the SSCP?

No. The changes do not affect the experience requirement. For the SSCP, a candidate is required to have a minimum of one year of cumulative work experience in one or more of the seven domains of the SSCP CBK.

Question 8. Where can I practice exam based questions for the new changes?

I have created two courses for the same. The links to these courses are given below. Please be rest assured that these practice questions have been made considering the new changes that have been brought in. SSCP Mock Exam 2 is also coming in November.



Question 9. Is there a training available with respect to the new course changes?

For official training, you can check the (ISC)2 website. 
I would be uploading the complete training course on Teachable which will reflect all the changes. This training will contain all the new topics and the updated course content. A new tab called the “SSCP Training Course” will be available in November on the website.

Overall, the changes brought in by (ISC)2 do not reflect any major changes as such. Certain topics which have been added reflect the importance which (ISC)2 wants to showcase in certain areas. From a domain perspective too, the weight of “Cryptography” has increased, which makes more sense.

In case you have any more questions regarding the SSCP 2018, feel free to drop in as comments in the comment section below. I will be happy to answer them for you.

Happy Learning.

Tuesday, September 4, 2018

Single Sign On & Kerberos


Imagine Susie wants to log on to a company database, her own system, a web server, her webmail and other multitudes of applications. Since she needs to access so many resources, it is extremely important to have a set of credentials for accessing each of this resource. This means Susie must remember an approximate dozen passwords in order to access these resources. Susie finds a solution to this problem. She writes down every single username and password to access them.

Clearly, Susie is not alone in doing so. You may also be doing the same. Clearly, from an information security point of view, this is not a great solution. It may sound that different ids and passwords would provide more security, it ultimately ends up in more work for the administrator since there are more requests of password reset or greater chances of a breach if that notebook gets in the wrong hands.

So what needs to be done? Well, as usual, the intelligent minds gathered together and found a solution to this problem. They called it the Single Sign-On. You can call this a double-edged sword too. Why? We’ll learn about it a minute. 

Single Sign-On allows a user to enter credentials one time and be able to access all resources in primary and secondary network domains. This reduces the amount of time users spend authenticating to resources and enables the administrator to streamline user accounts and better control access rights. It improves security by reducing the probability that users will write down passwords and also reduces the administrator’s time spent on adding and removing user accounts and modifying access permissions. If an administrator needs to disable or suspend a specific account, he can do it uniformly instead of having to alter configurations on each and every platform.

This sounds really great as it solves all of our problems. Just one username and password and the world is yours, (Now that’s a lot), the resources are yours. 

Wish, life could be so simple. Single Sign-On (SSO) operates on an assumption that all platforms support the credentials in the same manner and will talk to each other, which is extremely rare, given the multitude of platforms and technologies which companies employ. Remember, the double edge sword mentioned earlier. It is simply that if you leak that one super powerful username and password to Thanos, you will see your resources vanishing like the Avengers.

So simply speaking, SSO technology allows you to access multiple resources through a single username and password. You enter the credentials and voila, you have everything you are authorized to access. It does help Susie as she doesn’t need to remember multiple passwords. She can keep one complex passphrase which is easy to remember, yet is extremely complex. 

One of the most commonly used SSO technology is Kerberos. 

If you have seen Harry Potter, you may remember the three-headed dog that was guarding the philosopher’s stone. The photo below may refresh your memory. Confused, as to why a three-headed dog related to SSO here? Kerberos is the name of a three-headed dog that guards the entrance to the underworld in Greek mythology. This is a great name for a security technology that provides authentication functionality, with the purpose of protecting a company’s assets.



So let’s understand everything about Kerberos but in a very simple manner. 

Kerberos is an example of a single sign-on system for distributed environments and is a de facto standard for heterogeneous networks.  Kerberos is like a family in which there are multiple family members and each has a role to play. Let’s hear the names of all these members with their introduction.

Key Distribution Centre – He is just like the father who is having all the money. The Key Distribution Center (KDC) is the most important component within a Kerberos environment. The KDC holds all users’ and services’ secret keys. It provides an authentication service, as well as key distribution functionality. The clients and services trust the integrity of the KDC, and this trust is the foundation of Kerberos security.

The father has a helping hand known as the TGS – ticket-granting service (the mother) which generates the ticket.

Principal – They are the users or the applications which ask for services from the KDC. You can think of them as the kids in the family. They have new requests every day for the father. (KDC). Let’s say, Cathy is one of the kids and requests for a chocolate from the father. So here, Cathy is the principal and the father will act like the KDC.

Hopefully, you understood the analogy. 

Now let’s take up a real situation to help out things into perspective.  This is how the Kerberos process would take place.

1. Cathy comes to Evil Corp to complete her assignment. She logs into her system by providing her credentials.

2. Her request goes to the Kerberos software in her system.

3. This software sends her request to the KDC (remember, KDC is the one which has all the secret keys).

4. KDC sends back Cathy a ticket (not to Europe for holiday !!), which is encrypted with her password.

5. If Cathy entered the right password, then the ticket would be decrypted. Understand it in this manner, if Cathy entered the right password in the beginning, her ticket which is received from the KDC would be valid, if not, then it would be an invalid ticket.

6. Now Evil Corp is in the business of selling user’s information on the black market. 

7. Cathy wants to access this database where all such illegal information is stored. 

8. In order to access this information, Cathy sends a request to access to this database server.

9. Cathy’s system sends a request to this database server, her system sends the TGT to the ticket-granting service (TGS), which runs on the KDC, and a request to access the database server.

10. Why is everyone sending each other tickets? I know. This is because of the trust factor. KDC is one whom everyone trusts. So everyone sends his/her requests to the KDC so that KDC can confirm to everyone whether this is an authorized entity requesting access or not.

11. The TGS creates and sends a second ticket to Cathy, which she will use to authenticate to the database server.

12. What does the second ticket contain? This second ticket contains two instances of the same session key, one encrypted with Cathy’s secret key and the other encrypted with the database server’s secret key.

13. Cathy’s system sends this second ticket to the database server for authentication. 

14. When the database server receives this second ticket, it verifies this by decrypting it. 

15. If it successfully decrypts it, this means it is a valid request. Post this validation, Cathy will get this access to the database server.

This is an extremely simplistic overview of what is going on in any Kerberos exchange, but it gives you an idea of the dance taking place behind the scenes whenever you interact with any network service in an environment that uses Kerberos.

What are your thoughts on this? Share your thoughts in the comments section below.

Monday, August 20, 2018

Copyright, Trademark, Patent, or License? Understanding the Differences


Copyrights, trademarks, patents, and licenses are each a different form of intellectual property (IP) rights protection recognized by U.S. law. The distinctions among them can be subtle and often the same product or service may involve more than one of these IP rights. How can you tell them apart when deciding how to protect your company’s assets? Here’s how.

Copyrights

Copyright protects the rights of “authors” in their original creative works. Copyrightable works include artistic creations, like novels, paintings, films, and songs, but also business-related works like software code, website designs, architectural drawings, marketing reports, and product manuals.
The author of a copyrighted work has the exclusive right to:
  • Reproduce (print or copy), publish, perform, display, film and/or record the creative content.
  • Create derivative works from the original work (for example, updates, revisions, summaries, translations, and adaptations).

Copyright protection arises automatically at the time the work is fixed in tangible form, either directly or through use of a machine, like a computer or a movie projector. Copyrights have a term equal to the life of the author plus 70 years. If a company is the owner of the copyright, it has a term equal to 95 years after the date the work is first made public.


Copyrighted works can be registered with the U.S. Copyright Office. Registration is optional but highly recommended. Registration provides legal benefits to the author, including the ability to enforce the copyright against infringers in court. Copyrighted works (registered and unregistered) can display the © symbol to provide notice that the author considers the work to be protected by copyright.

Trademarks

trademark is a symbol, word, slogan, design, color, or logo that identifies the source of a product or service, and distinguishes it from those made or provided by others. Trademarks can represent:
  • The product or service itself (ex. iPhone)
  • A feature or element of the product or service (ex. FaceTime)
  • The manufacturer or provider of the product or service (ex. Apple).
A “service mark” is a trademark that identifies a service instead of a tangible product.
The owner of a trademark has the right to prevent infringers from unfairly competing with the owner by using marks that are “confusingly similar.” In the United States, trademark rights can arise in two ways:
  • Automatically by use of the trademark in the marketplace in connection with a product or service (“common law” or unregistered trademarks).
  • By registration of the trademark with the U.S. Patent and Trademark Office (PTO) (“registered” trademarks).

Although not required by law, registering a trademark with the PTO confers many benefits on the trademark owner. For example, a U.S. trademark registration gives the owner nationwide rights to use the mark in connection with the goods and services included in the registration. Common law trademarks only create rights in the specific geographic territories where the owner is actually using it.

Common law trademarks can be used with the ℠ or ™ symbols. Registered trademarks can be used with the ® symbol. Both types of trademarks are valid so long as your business continues to use them. However, registered trademarks must be renewed periodically with the PTO.

Patents

Patents protect the rights of inventors. A patent is a 20-year exclusive property right granted by the PTO for an invention. 
A patent entitles you to exclude others from making, using or selling your invention. Once your patent is issued, you have an obligation to enforce it against unauthorized third parties violating your rights. If you don’t, a court can declare your patent “abandoned” and unenforceable.
Most patents are utility patents that protect “any new and useful process, machine, article of manufacture, or composition of matter, or any new and useful improvement thereof.” To obtain a utility patent, you will need to prove to the PTO, through claims in your patent application, that your invention is useful, novel and non-obvious. Other types of patents often sought by businesses include:
  • Design patents, which concern “new, original, and ornamental design embodied in or applied to an article of manufacture” not affecting the article’s function;
  • Business method patents, which protect new methods of doing business, such as those used in banking, tax compliance and e-commerce, for example; and
  • Plant patents, which protect invented or discovered asexually reproduced plants that are new and distinct.
Licenses

Licenses are contracts that transfer IP rights from the owner of the rights (the Licensor) to a third party who wants to use them (the Licensee). They can be exclusive (rights are granted to only one Licensee) or non-exclusive (rights are granted to multiple Licensees). A Licensee typically pays the Licensor a royalty in exchange for the right to use the IP rights. Royalties are usually based on a percentage of the revenue the Licensee generates from the sale of products using the licensed IP rights.
Licenses can be valuable assets for your business. For the Licensor, licenses can generate a significant revenue stream from royalty payments. For the Licensee, licenses can enable it to sell superior products in the marketplace.

Sunday, August 5, 2018

Access Control Models - DAC, MAC, RBAC , Rule Based & ABAC



Identity and Access Management is an extremely vital part of information security. An access control model is a framework which helps to manage the identity and the access management in the organization. There are 5 main types of access control models: discretionary, rule-based, role-based, attribute-based and mandatory access control model. Every model uses different methods to control how subjects access objects. While one may focus on rules, the other focus on roles of the subject. As a security professional, we must know all about these different access control models. While one company may choose to implement one of these models depending on their culture, there is no rule book which says that you cannot implement multiple models in your organization.

These models are built into the core or the kernel of the different operating systems and possibly their supporting applications. Every operating system has a security kernel that enforces a reference monitor concept, which differs depending on the type of access control model embedded into the system. For every access attempt, before a subject can communicate with an object, the security kernel reviews the rules of the access control model to determine whether the request is allowed.

So let’s understand what do these models have to say about themselves:

1. Discretionary Access Control Model

If you have used any platform such as Windows, Mac or Linux, you can easily understand and appreciate this model. If you create a folder in any of these, you can easily add/delete/modify the permissions which you want to give to different subjects. Sounds confusing? Well, it isn’t. Let’s take an example to understand this.

                             



I have created a folder named “SSCP Video Course”. Now since I’m the owner, it is my discretion to assign various permissions for users. I can go to the”Security” Tab and “Edit” permissions and define what users need to be given “Full control” or which users can only be given “Read” Access.
A system that uses discretionary access control (DAC) enables the owner of the resource to specify which subjects can access specific resources. This model is called discretionary because the control of access is based on the discretion of the owner.

There is another term which is used quite often with reference to the models. It is the Access Control List. An ACL for a file would list all the users and/or groups that are authorized access to the file and the specific access granted to each.

While all seems good in the world of DAC, there are some issues with this model. While this model offers the best flexibility amongst any of the model, it is also its weakest point. For example, if a user opens an attachment that is infected with a virus, the code can install itself in the background without the user being aware of this activity. This code basically inherits all the rights and permissions that the user has and can carry out all the activities a user can perform on the system. It can send copies of itself out to all the contacts listed in the user’s e-mail client, install a back door, attack other systems, delete files on the hard drive, and more. The user is actually giving rights to the virus to carry out its dirty deeds, because the user has very powerful discretionary rights and is considered the owner of many objects on the system. And the fact that many users are assigned local administrator or root accounts means that once malware is installed, it can do anything on a system.

2. Mandatory Access Control (MAC) Model

Do not confuse this with Apple MAC, this model is not even remotely related to it. This model is the complete opposite of the DAC model.  In a mandatory access control (MAC) model, users do not have the discretion of determining who can access objects as in a DAC model. An operating system that is based on a MAC model greatly reduces the number of rights, permissions, and functionality a user has for security purposes.

Thursday, July 19, 2018

Understanding the GDPR: General Data Protection Regulation


The GDPR–or General Data Protection Regulation–is a regulation passed by the European Union on April 27, 2016, with an effective start date of May 25, 2018. Officially classified as regulation 2016/679, the GDPR expands upon and replaces the Data Protection Directive 95/46/EC of 1995. It serves as the EU’s effort to synchronize and harmonize laws on citizen and resident data privacy throughout its member states.

GDPR is based on Privacy by Design/Default, a set of user-centric principles that bequeath a sacred status to user privacy from the get-go rather than as an afterthought. Piggybacking on that is the ability of users to sue organizations under the GDPR who might mishandle personal data. To accomplish this, the GDPR mandates new user-oriented information-handling processes to which EU companies will soon find themselves beholden, not to mention subject to significant penalties in the event of a violation.

The complete text of the GDPR legislation clocks in at 88 pages. There exist within it 173 recitals and 99 articles, each one applying universally to all EU member states. The key provisions of this sweeping legislation are provided below and constitute the essence of what the law entails and how it affects data storage and retrieval for all related EU entities.

Who the Law Protects

There is a slight bit of confusion when it comes to just who falls under the protective auspices of the GDPR measure. The term “natural person” appears frequently throughout the text, and while this indeed refers to EU citizens, it actually extends further to those merely residing in the EU.

To wit, a natural person in EU nomenclature is any human possessing “legal personality”. That’s a very law-like definition that essentially boils down to a person who acts on their own behalf rather than in the interests of a business entity (sometimes known as a “legal entity”) or a government entity (or “public entity”).

To simplify matters, all humans native to or residing inside the EU with data to protect are blanketed under the term “data subject”. The rights of these data subjects to control and even extensively delete their private data are at the heart of the GDPR.

How GDPR Defines Personal Data

The GDPR defines personal data quite simply: Information (“data”) that can be used to identify a natural person (“data subject”). This seems self-evident on its surface, and indeed, certain identity-related elements fall naturally within this definition, such as name, ID number, home address, and more. But in the current era of sophisticated online data tracking technology, the amount of transmittable, personally identifiable data has ballooned (at least in the EU’s opinion), and with it, the number of privacy touch points potentially available to corporate and government bodies.

This massive list includes, but is not limited to, online identifiers such as IP addresses, social media accounts, email addresses, accounts numbers, browser cookies, and more. Constituent to this is direct identifiers and indirect identifiers, both of which establish the data subject’s identity by degrees. For instance, a direct identifier is a name, ID number, home address, and so on. Indirect identifiers include the date of birth, location, or even title, and while they don’t pinpoint data subjects directly, they can nevertheless unmask a person’s identity when used in concert.