for the exercise recap "Using SET to perform social engineering" can you detail how SET the social engineering toolkit can be used to send mass emails and include a malicious meterpreter session. describe what metasploit is and how we use it to catch the reverse shell, also describe what a reverse shell is. Include extra guidance on a few of the interesting functions of the meterpreter payload like keyscan_start, Keyscan_dump, uictl, screenshare and webcam_stream. Of course include the legal and ethical disclaimer.
Vulnerabilities, Threats and Risk
All activity is subject to a degree of risk
Risk can be defined as:
In order to manage risk proportionally we must quantify risk
We can do this:
Qualitatively
Quantitatively
We cannot eliminate risk entirely
Instead we must reduce risk to an acceptable level
* ISO 31000 risk management standard
Risk: The effect of uncertainty on objectives *
Content with Half Vertical Image
Calculating Risk
Likelihood
X
Impact
Vulnerability
=
Threat
+
A weakness in an asset
An event or actor which could exploit a vulnerability
An event or actor which could exploit a vulnerability
RISK
Gap Analysis
Where we want to be
Where we are
GAP
Recording Risk
Risk
A measure of threats, vulnerabilities, impact, and probability
Risk Registers
Risk description
Severity
Owner of the risk item
Identified mitigations
Often utilize heat maps
Responding To Risk
Risk management strategies
Describe the proactive and systematic approaches used to:
identify
assess
prioritize
mit…
Can you include a section at the bottom which summarises some of the key activities from the exercise "Configuring Examples of Security Control Types". The lab uses windows folder access permissions to control user access based on active directory groups like "domain_users" and "domain_admins" - Controlling user folder access in thie way is a *preventative control*. Windows local security policy can be used to implement file and folder access logging which is a form of *detective control* file and folder auditing can also be used to log deletions. The exercise also uses local security policy to create a logon banner message which is used to remind users that access to the machine is subject to the AUP, this warning serves as a *directive control* encouraging compliance with the AUP. The exercise then demonstrates 2 *corrective controls*. The first is built into windows and automatically recovers from a crash using what is commonly known as the blue screen of death BSOD. The second is a script which uses powershell SigVerif to detect changes in an important file and return the file to its proper state when a change is detected.
Chapter Title Slide
Understand the multidisciplinary nature of Information Security
Understand the CISO role
List some of the management roles in Information Security
List some of the Technical and Non-Technical roles in Information Security
Chapter Summary Slide
There is no single person who can cover all responsibilities
There is no single department that can cover all responsibilities
Cyber Security risk is managed in different ways
By individuals with different skills
Who form part of different teams
Cyber Security is a team effort
Overall Responsibility lies with:
CIO
Chief Information Officer
Enable business growth through technology
CISO
Chief Information Security Officer
Ensures technology is secure
Historically the CISO has reported to the CIO
Some organisations allow direct reporting to the CEO or board
Executive Cyber Security Roles
Both set strategy and direction
Represent their domain (IT or security) at the board level
Are accountable for risk, compliance, and long…
Can you change the "revision guide" button to be a drop down menu and call it "lesson recaps" and rename the revision.html to "lesson_1.html"
can you remove the linux cli section from the revision sheet and expand the Lab exercise reminder to explain that we covered online and offline password attacks. Explain breifly what each is then include a short commandline reference for hydra, john (john the ripper) and windows powershell password policy enumeration and configuration
can you create a separate page to to serve as a recap for these slides? This is the text from some slides. Dont quote it verbatim but identify the underlying themes and create a section that focusses on each one - like a revision guide. Here is the content: In this course, you will engage in activities that perform probing actions and may be used to compromise computer systems and networks
You will perform these actions to obtain the skills required to make effective computer security risk assessments
Performing these actions against systems or networks that you are not authorized to access is unethical and subject to legal prosecution in most jurisdictions
Disclaimer
Security Fundamentals
Chapter 1
Chapter Title Slide
Understand the CIA triad
Understand the means and motives of different threat actors
Find specific guidance on APTs
Understand the concept of AAA
APT - Advanced Persistent Threat AAA - Authentication Authorisation and Accounting
Chapter Summary Slide
Confidentiality
Information can only be read by authorised users
Integrity
Information can only be modified by authorised users
Availability
Information is accessible to authorised users - in a timely manner
Non-repudiation
Changes and access to data is recorded in a way which is undeniable
Information Security
Explain the construction of the prompt and what each part means ie USER@HOST:/CURRENT/WORKIN…
Can you also add a section before common ports about the TCP 3 way handshake and how we can use this to scan ports. Include some very basic and simple nmap command examples
create a Comptia Security + Knowlage checklist page which is designed to be printable. It should cover basic linux CLI commands, What a MAC address is and how it gets traffic to the next hop, What an IP address is and how every computer has one, What ports are and how every service the computer provides will listen on a port. Include a diagram of the TCP/IP stack with an description next to some fake addresses. for example "Layer 2 : Addressed to the next hop, in this case the default gateway. Layer 3 : addressed to the web sites IP address. Layer 4 : Addressed to the port the web server is listening on. Layer 7 : a message the web server will understand asking for the main page of the site." use diagrams and examples where appropriate.
