In this section of the course,
we are going to discuss detection and mitigation.
The detection and mitigation section
of the course focuses on domain 3, security engineering,
as well as domain 4, security operations,
specifically objectives 3.4 and 4.2.
Objective 3.4 states that given a scenario,
you must be able to implement
hardware security technologies and techniques.
Objective 4.2 states that given a scenario,
you must be able to analyze vulnerabilities and attacks
and recommend solutions to reduce the attack surface.
Detecting and mitigating threats
is essential to maintaining security and functionality.
Effective detecting and mitigation strategies
focused not only on identifying potential risks,
but also on designing systems that can withstand
and respond to threats and attack.
This includes ensuring
that sensitive data remains protected,
access is properly controlled,
and that systems can safely recover
from unexpected failures.
By implementing these measures,
organizations can strengthen their defenses
and ensure that even in the face of attacker failure,
their systems remain secure and operational.
As we go through this section, we will cover many topics
related to detection and mitigation,
including tamper detection and countermeasures,
design mitigations, validation mitigations, safe functions,
access control mitigations,
confidentiality management, update management,
and fail-safe mechanisms.
First, we will look at tamper detection and countermeasures.
Tamper detection and countermeasures identify and respond
to unauthorized attempts to alter
or manipulate a system or device.
Tamper detection mechanisms such as seals, sensors,
or cryptographic checks are designed to alert
when a system has been compromised,
triggering an appropriate response.
Countermeasures include physical barriers, encryption,
or system shutdowns that prevent
or minimize the damage from tampering.
For example, an ATM might use tamper evidence seals
and sensors to detect unauthorized access,
and if tampering is detected,
the machine could automatically disable access
to its cash vault and alert authorities.
Next, we will explore design mitigations.
Design mitigations involve strategically incorporating
security measures during the system design phase
to prevent or reduce the impact of vulnerabilities.
Design mitigations include security design patterns,
defense-in-depth, and dependency management.
Security design patterns are best practices
such as input validation, least privilege
and secure defaults
that guide the secure architecture of systems.
Security design patterns help developers build defenses
directly into the structure of applications.
Defense-in-depth is a layered security approach
where multiple protective measures are implemented
to provide redundancy, ensuring that if one layer fails,
others remain to protect a critical system.
Dependency management involves carefully selecting,
monitoring, and updating external libraries or components
to prevent security flaws and third party dependencies.
In practice, a software application
might use security design patterns
to enforce secure coding practices.
Employ defense-in-depth by incorporating firewalls,
encryption, and access controls, and manage dependencies
by regularly updating all third party components.
After that, we will look at validation mitigations.
Validation Mitigations are security measures
that ensure data entering or leaving a system
is properly validated and encoded.
Validation Mitigations prevent exploitation
through malicious input or output.
Validation Mitigation concepts include input validation
and output encoding.
Input validation is checking and sanitizing data provided
by users or external sources
to ensure it meets expected formats
and does not contain harmful content.
Output Encoding converts data into a secure format
before it is processed or displayed,
ensuring that it cannot be interpreted as executable code.
This technique is crucial not only
for preventing cross-site scripting attacks,
but also for safeguarding internal resources
and systems from unintended code execution,
even if the input validation fails.
For example, a web application might use input validation
to reject any user input that contains unexpected characters
or patterns, and employ outputting coding
to ensure that any data displayed on the website
is rendered safely.
Next, we will explore safe functions.
Safe functions are programming functions
that operate securely and reliably.
Safe function concepts include atomic functions,
memory-safe functions, and thread-safe functions.
Atomic functions are designed to complete operations
in a single indivisible step,
ensuring that operation is either fully completed
or not executed at all.
In this way, atomic functions prevent the possibility
of interference from other processes
and ensure data consistency even in concurrent environments.
A concurrent environment is a computing scenario
where multiple processes or threads
are executed simultaneously or in overlapping time periods.
Next, memory safe functions are used
to prevent common memory related vulnerabilities
such as buffer overflows or memory leaks.
Memory-safe functions manage memory allocations
and access securely
by ensuring that memory boundaries are respected,
automatically freeing up memory when it is no longer needed,
and preventing the allocation of memory
that exceeds the available capacity.
Finally, thread safe functions ensure
that when multiple threads execute simultaneously,
the thread-safe function operates correctly without causing
race conditions or data corruption.
For example, a software application
might use atomic functions to update shared resources,
memory-safe functions to handle dynamic memory allocations
and thread-safe functions to manage concurrent operations.
Following that, we will look at access control mitigations.
Access control mitigations implement measures
that restrict access to system resources
and functionalities.
Access control mitigation concepts include least privilege,
least function or functionality and allowlisting.
The principle of least privilege ensures that
users or processes are granted
only the minimum levels of access or permissions,
necessary to perform their tasks.
In this way, the principle of least privilege
reduces the risk of unauthorized access or misuse.
Least function or functionality
limits the available system functions or features
to only those necessary for operations.
In this way, least functionality prevents the exploitation
of unnecessary or vulnerable components.
Allowlisting restricts access to a predefined allowed
list of approved applications or IP addresses.
In this way, allow listing blocks anything
not explicitly permitted.
In application, an organization might configure its servers
to grant only necessary access rights to each user
utilizing the principle of least privilege.
Disable all unnecessary services
demonstrating least functionality
and implement allowlisting to ensure
that only trusted applications can be executed.
Then, we will explore confidentiality management.
Confidentiality management is safeguarding
sensitive information to prevent unauthorized access
or disclosure.
Confidentiality management concepts include indexing,
key rotation, encryption, and code signing.
Indexing involves organizing and structuring sensitive data
so that it can be efficiently retrieved
while ensuring that underlying sensitive information
remains protected and inaccessible to unauthorized users.
Secrets management including key rotation
ensures that encryption keys and other sensitive credentials
are regularly updated to minimize the risk of compromise.
Next, encryption is used to protect data and secrets
by converting them into a secure format
that is unreadable without the correct decryption key.
Finally, code signing verifies the authenticity
and integrity of software using encryption,
ensuring that it has not been tampered with.
In practice, an organization might use indexing
to securely manage access to encrypted customer records,
implement regular key rotation for its encryption systems,
and apply code signing to its software updates.
Next, we will look at update management.
Update management is the process of ensuring
that all components of a system, including firmware,
system images, hypervisors, operating systems and software,
are regularly updated and patched.
Update management concepts include
updating and patching firmware, system images,
hypervisor considerations, operating system considerations,
and software considerations.
Firmware updates address the embedded software
in hardware devices.
Updating firmware ensures
that foundational system components are secure
and functioning correctly.
Updating system images and hypervisors
helps maintain the integrity
and security of virtual environments.
This is because the system images and hypervisor updates
often include critical patches.
Regular operating system and software updates
ensure that all applications and operating systems
are protected against known vulnerabilities,
reducing the attack surface.
For example, an organization might implement
a robust update management process
that regularly updates the firmware on its network routers,
the hypervisor software running its virtual machines,
and the virtual operating systems
and software application on all endpoints,
ensuring that the entire infrastructure is secure
and up-to-date.
Finally, we will explore fail-safe mechanisms.
Fail safe mechanisms are systems designed to default
to a secure state or a safe operational mode
in the event of a failure or security breach.
Fail-safe mechanism concepts include fail-secure
and fail-safe.
Fail-secure mechanisms prioritize maintaining security
by locking down access or shutting down critical functions
when a failure occurs.
Fail-secure mechanisms prevent unauthorized access,
even if it causes a temporary denial of service.
On the other hand, fail-safe mechanisms focus on safety,
ensuring that systems continue to operate in a way
that prevents harm or damage,
even if this means compromising some level of security.
For example, in a secure building access system,
a fail-secure door lock might remain locked
if the power fails, preventing unauthorized entry.
While a fail-safe door lock might unlock to allow occupants
to exit safely during an emergency like a fire.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course,
and we will review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So let's get ready to dive into detection and mitigation
in this section of the course.