Security Vulnerabilities, Threats and Countermeasures

OUTLINE: Common Security issues across system layers

• Hardware
  • Hardware Components
  • Protection Mechanisms
  • Memory Protection Mechanism
  • Input/Output Devices
  • Firmware
• Protecting Client and Server Based Systems
• Database Systems Security
• Cloud Computing Security
• Internet of Things (IoTs) Security
• Web-Based Security
• Mobile Device Security
• Operating System Security

Operating states

• Supervisory state: privileged – all access mode
  • Can execute all machine instructions
  • Can reference all memory offsets
• Operating/Problem state: User mode
  • Limited access and executions based on the authorization
  • In problem state: privileges are low and all access requests must be checked against credentials for authorization before they are granted or denied.

Read only memory (ROM)

• Programmable Read-Only Memory (PROM)
• Erasable Programmable Read-Only Memory (EPROM)
• Electronically Erasable Programmable Read-Only Memory (EEPROM)
• Flash

Random access memory (RAM)

• Real
• Cache
• Registers

• Memory protection prevents one process from accessing the memory space of another.
• By controlling access to memory, an OS can maintain a safe environment where processes can execute without interference, thus preserving data integrity and system reliability.
• In modern computing, OS like Windows, Linux, and macOS rely heavily on memory protection to manage multiple processes running simultaneously.
• Each program/ process, requires its own memory space to function properly. Memory protection ensures that these processes do not which could lead to data interfere with one another’s memory, corruption, system crashes, or unauthorized data access.

• Memory protection is implemented through:
  • Hardware Mechanisms: Memory Management Unit (MMU) within the CPU translates virtual addresses to physical addresses and enforces access controls (checks access permissions in real-time)
  • Software Mechanisms: includes the OS kernel, which manages the allocation and protection of memory spaces.

• Paging & Segmentation: Divides memory into chunks (pages or segments) with specific access rights (read, write, execute).
• Address Space Layout Randomization (ASLR): Randomizes memory addresses for system and application processes, making it difficult for attackers to locate target code.
• Data Execution Prevention (DEP): Marks memory regions as non-executable to prevent malware from running code there.
• Protection Keys (MPK): Assigns a numeric key to memory blocks, allowing fast permission changes.
• Process Isolation: Prevents one application from reading/writing the memory of another, preventing unauthorized data theft.
• Kernel Protection: Protects the operating system's memory space from user-level malware.
• Buffer Overflow Mitigation: Blocks attacks where malicious actors try to overwrite memory to change program flow.

• Secondary memory protection refers to the strategies, technologies, and practices designed to secure non-volatile storage devices (such as HDDs, SSDs, USB drives and cloud storage) against unauthorized access, data theft, malware, and tampering.
• Secondary storage retains data when power is off, making it a prime target for long-term data exfiltration.
• Secondary Memory Protection Mechanisms:
  • Encryption (At-Rest): Utilizing full-disk encryption or file-level encryption - if a device is lost, stolen, or accessed unauthorized, the data remains unreadable.
  • Immutable Backups & Object Locking: Use technologies that create "read-only" copies of data, which cannot be modified, encrypted, or deleted by ransomware.
  • Air-Gapping: Maintaining physical separation between secondary storage and the network to isolate backups from cyber-attacks.
  • Access Controls & Authentication: Restricting access to sensitive storage partitions using multi-user authentication (MUA) or strict permissions to prevent accidental or malicious deletion.
  • Physical Security: Locking down servers and removing removable media (USB drives).

• Input: Keyboards, mice, scanners, microphones, cameras.
• Output: Monitors, printers, projectors, speakers.
• Storage/Peripherals: USB drives, external hard drives, IoT sensors.
• Modems/Routers: Ubiquitous broadband and wireless connectivity is common nowadays Can these basic devices present security risks to a system?

Physical Security: Secure devices and cables to prevent tampering or unauthorized swapping. Use locks, surveillance, and access badges to limit physical access.

Port Control: Disable/ physically remove unused connection ports like USB, CD/DVD drives to prevent malware insertion or data theft.

Software Updates: Consistently update firmware on I/O devices and software drivers on computers to patch vulnerabilities.

Authentication & Access Control: Implement strong passwords or biometric authentication for accessing devices and systems.

Network Segmentation: Isolate IoT and peripheral devices on a separate network to prevent a compromised device from affecting the main network.

Encryption: Utilize secure communication protocols like TLS to encrypt data transmission between devices.

Input Validation: Implement input validation to ensure integrity and protect against malicious code

Client-side security secures the user endpoint from where they access the network A client-side attack is any attack that is able to harm a client e.g., A malicious website that transfers malicious code to a vulnerable browser running on the client.

It focuses on

Endpoint Security: Installing antivirus and Endpoint Detection

securing

and Response (EDR) solutions to protect against malware.

end-user devices

Browser Security: Implementing Content Security Policies (CSP)

(laptops,

to block malicious scripts and using secure cookie attributes

mobile

(HttpOnly, Secure, SameSite).

devices) and

Input Sanitization: Validating all user inputs on both the client

browser-

and server side to prevent script injection.

based applications.

It includes: Code Obfuscation: Making client-side code (JavaScript) difficult

to understand to deter reverse engineering.

Patching and Updating: Ensuring browsers, operating systems, and installed software are updated to patch vulnerabilities.

• Server-side security protects data and applications
• Main concern in such systems include:
  • Data flow control
  • Management between processes, devices, networks, or communication channels with minimal delay
  • Load balancing
  • Efficient transmission with minimal delays or latency
  • Reliable throughput using hashing and confidentiality protection with encryption
• A denial-of-service & DDoS attacks can be a severe detriment to data flow control.

Servers are often the primary target as they house sensitive data, making them critical points for attack. It Includes:

• Firewalls & WAFs: Next-Generation Firewalls (NGFW) monitor network traffic and block dangerous traffic. Web Application Firewalls (WAF) protect against application-layer attacks like SQL injection and cross-site scripting (XSS).
• Patch Management: Regular updates for operating systems and applications.
• Access Control: Implementing Multi-Factor Authentication (MFA) and Role-Based Access Control (RBAC) to ensure only authorized personnel can access critical systems.
• Encryption: Protecting sensitive information if physical drives are stolen.
• Intrusion Detection/Prevention (IDS/IPS): Monitoring network traffic in real-time to identify and block suspicious activities.
• Server Hardening: Disabling unnecessary services, closing unused ports, and using hardened OS configurations.
• DDoS Mitigation: Tools and strategies to protect against DoS & DDoS attacks that aim to make services unavailable

• Database systems security protects databases from cyber threats, ensuring data confidentiality, integrity, and availability.
• It involves securing the database management system (DBMS), applications, physical servers, and network infrastructure through access controls, encryption, and regular auditing.
• Key practices include robust authentication, patch management, and monitoring for threats like SQL injection and unauthorized access

• SQL/NoSQL Injection Attacks: Attackers insert malicious code into queries to manipulate the database.
• Insider Threats: Malicious or careless employees with legitimate access.
• Misconfigured Databases: Improper settings, such as default passwords or open ports, leading to vulnerabilities.
• Weak/Missing Encryption: Allowing sensitive data to be read if the system is breached.
• Data Loss/Ransomware: Attackers encrypt or steal data, demanding ransom.

Best

roles.

• Use Data Masking: Hide sensitive data in

Practices

non-production environments.

for

• Secure Backups: Regularly back up data and encrypt the backups to ensure

Protecting

availability.

Database

• Vulnerability Scanning: Frequently test for

Systems

vulnerabilities and perform penetration testing.

• Ensure Physical Security: Secure the physical or virtual servers hosting the database

Cloud security involves protecting data, applications, and infrastructures in cloud environments (AWS, Azure, Google, Alibaba) from threats.

It uses tools like encryption, firewalls, and IAM to manage risks such as data breaches, misconfigurations, and API vulnerabilities.

Hypervisor, virtual machine monitor (VMM) Is the component of virtualization that creates, manages, and operates the virtual machines.

Elasticity: Flexibility of virtualization and cloud solutions to expand or contract based on need Cloud computing

• PaaS
• SaaS
• IaaS

Shared Responsibility Model: The Cloud Service Provider (CSP) secures the infrastructure ("of" the cloud), while the customer secures their data, applications, and access ("in" the cloud).

Identity and Access Management (IAM): Crucial for controlling user access to resources, often requiring Multi-Factor Authentication (MFA) to prevent account hijacking.

Data Protection: Involves encrypting data at rest and in transit, and ensuring secure backups.

Visibility and Compliance: Utilizing tools like Cloud Security Posture Management (CSPM) to monitor configurations and ensure regulatory compliance.

Cloud-Native Protection: Adopting platforms like CWPP (workload protection) and CNAPP (cloud-native application protection) for real-time monitoring and threat detection.

Best

• Update Firmware/Software: Regularly update device firmware to patch known vulnerabilities.

Practices

• Network Segmentation: Isolate IoT devices on a separate network to prevent attackers for from accessing main computers, servers, or personal data.

Securing

• Implement Zero Trust: Treat every device, user, and connection as a potential threat by requiring continuous authentication.

IoT

• Disable Unused Features: Turn off unused features like Bluetooth, remote management

Devices

to reduce potential entry points.

• Use Enhanced Authentication: Enable Multi-Factor Authentication (MFA) whenever available.

Web-based cybersecurity involves protecting websites, web applications, and APIs from malicious attacks, preventing data

.

breaches, and ensuring service availability Key components of Web Security include:

Web Application Firewalls (WAF): Filter and monitor HTTP traffic between web apps and the internet to block threats.

Vulnerability Scanning: Automated tools that scan web applications for known weaknesses.

Secure Coding Practices: Developing code with security in mind to prevent common vulnerabilities, often aligned with OWASP Top 10 guidelines.

API Security: Protecting application programming interfaces from unauthorized access or data leaks

• View hosted web pages
• Explore what automation technologies in use security
• Look for information that should not have been evaluation or posted penetration
• How files and backups are handled test of an
• evaluating the site’s transmission security organization’s
  • Secure Sockets Layer (SSL)/Transport Layer web services Security (TLS)
• Evaluate authentication and session includes: management
• Evaluating the cryptography of the site and the methods used for data validation and sanitization
• Other activities include: checking for DoS defences, evaluating risk responses, and testing error handling.

Common Threats and Defense Techniques:

• SQL Injection (SQLi): Attackers manipulate database queries.
  • Mitigation: Validating and sanitizing all user inputs.
• Cross-Site Scripting (XSS): Injecting malicious scripts into trusted websites.
  • Mitigation: Escaping user-provided content.
• DDoS Attacks: Flooding servers with traffic.
  • Mitigation: Utilizing DDoS mitigation services.
• Broken Access Control: Unauthorized access to user accounts or data.
  • Mitigation: Implementing strict authentication mechanisms

Device Security

• The range of potential security options or features available for a mobile device which are useless if not activated

Application Security

• Focuses on the security of applications and functions used on those devices

BYOD Concerns

• Bring your own device (BYOD) is a policy that allows employees to bring their own personal mobile devices into work and use those devices to connect to (or through) the company network to business resources and/or the internet.
• This may improve employee morale and job satisfaction

Be sure to consider the security options of a new device before you make a purchase decision.

• Full device encryption
• Remote wiping
• Lockout
• Screen locks
• GPS
• Application control
• Storage segmentation
• Disabling unused features

By default, No app can execute on the

device but those I give them the

Security concerns include:

privilege

• Key management: Most of the failures of a cryptosystem are based on the key management rather than on the algorithms
• Credential management: storage of credentials in a central location
• Authentication: good authentication include: passwords and biometrics
• Geotagging: can be used to determining when a person normally performs routine activities
• Encryption: When this is available in the mobile device, it should be enabled
• Application whitelisting: It is a security options prohibits unauthorized software from being able to execute (deny by default and allow by exception). It is the opposite of blacklisting: allow by default and deny by exception

The OS must employ protection mechanisms to keep the computing environment stable and to keep processes isolated from each other.

Computer system designers should adhere to a number of common protection mechanisms when designing secure systems includes:

• Technical Mechanisms
• Policy Mechanisms overview

• Layering: Implement a structure similar to the ring model used for operating modes
• Abstraction: access controls and operation rights are assigned to groups of objects
• Data hiding: important characteristic in multilevel secure systems. data hiding relies on placing objects in security containers that are different from those that subjects occupy to hide object details from those with no need to know about them.
• Process Isolation: requires that the operating system provide separate memory spaces for each process’s instructions and data.
• Hardware segmentation: similar to process isolation. The main difference is that hardware segmentation enforces these requirements through the use of physical hardware controls rather than the logical process isolation controls imposed by an operating system.

The policy mechanisms are extensions of basic computer security policy, but the applications described in this section are specific to the field of computer architecture and design.

• least privilege: minimal required privileges
• Separation of duties: task should be assigned to more than one person
• Accountability: Who do what? Recording activities that include administrators or other trusted individuals with high levels of privilege activities on the system

THE END...