2025-12-11 Introduction to Cyber Security Course Summary (Gísli)¶

He’s currently going over the material in a different order, an order that “makes more sense”.

Defense in Depth¶

Least privilege:
- TL;DR: Only give users the bare minimum privileges that they need.
- Explained in detail: Least privilege is the principle that users, programs, and systems should only have the minimum level of access or permissions necessary to perform their tasks. This helps reduce the attack surface and limits the potential damage that can be caused by compromised accounts or software.
Fail-safe defaults:
- TL;DR: Default to denying access, unless explicitly allowed.
- Explained in detail: Fail-safe defaults is the principle that systems should be designed to default to a secure state in the event of a failure or unexpected condition. This means that if something goes wrong, the system should deny access or functionality rather than allowing it by default. This helps prevent unauthorized access or actions when the system is not functioning as intended.
Economy of Mechanism:
- TL;DR: Keep it simple.
- Explained in detail: Economy of mechanism is the principle that security mechanisms should be as simple and straightforward as possible. Complex systems are more difficult to understand, analyze, and secure, which can lead to vulnerabilities. By keeping security mechanisms simple, it becomes easier to identify and address potential weaknesses.
Complete mediation:
- TL;DR: Complete mediation means that every access to every resource must be checked for authorization.
- Explained in detail: Complete mediation is the principle that every access to every resource must be checked for authorization. This means that every time a user or process attempts to access a resource (such as a file, database, or network service), the system must verify that they have the necessary permissions to do so. This helps prevent unauthorized access and ensures that security policies are consistently enforced.
Open design:
- TL;DR: Don’t rely on secrecy of design (security by obscurity) or implementation for security.
- Explained in detail: Open design is the principle that the security of a system should not depend on the secrecy of its design or implementation. Instead, security should be based on well-established principles and practices that can be openly reviewed and analyzed. This allows for greater scrutiny and helps identify potential vulnerabilities that may not be apparent in a closed or secretive design.
Psychological acceptability:
- TL;DR: Your security principles need to be accepted by the user, or else the user will circumvent it.
  - E.g. if you have super super complicated passwords, then the users might just write it down on a sticky note and basically make it completely useless.
- Explained in detail: Psychological acceptability is the principle that security mechanisms should be designed in a way that is user-friendly and easy to understand. If security measures are too complex or inconvenient, users may be tempted to bypass them or find workarounds, which can compromise the overall security of the system. By designing security mechanisms that are intuitive and easy to use, users are more likely to comply with security policies and practices.

The layered approach¶

Every part of the system needs to be secure, there shouldn’t be just one super secure layer.

If one layer fails, the next one should catch it.

Computer Networks¶

He’s not expecting us to know everything about computer networks, but we should understand the basics.

We should know:

It’s organized into layers in OSI Model and TCP IP Model. We don’t have to memorize the layer numbers.
Data is split up into packets.
The packets don’t just make one hop, they hop again and again between places.
- Just like packages you get in the mail! They transfer between transport hubs!
The packets are re-assembled on the other side.

Identity & Addressing¶

Problem: how do we identify a device among billions? todo

Finding the path¶

Problem: How does a packet know which wire leads to the destination? It uses routing tables. - Layer 2(LAN): MAC address table / switching table

Physical Layer ¶

For the cyber security final exam, we should know roughly what the purpose is of these layers, and have some idea of how this can be attacked.

Link layer¶

Node-to-node delivery on the same network/medium.

Ethernet
WiFi

Network Layer ¶

Delivery of packets to devices anywhere in the network.

This requires:

Addressing (IP addresses)
- Routing (finding the path)
Forwarding (moving the packet from one link to another)

Transport Layer ¶

Application multiplexing (ports). Essentially, it makes sure that data gets to the right application on the device.

Security context:

Open ports are potential attack vectors.
- An open port is like an open door into your house. The definition of an open port is that there is an application listening on that port.
- We can find/scan for open ports using tools like nmap.
TCP SYN flooding attack:
- The attacker sends a lot of TCP SYN packets to a target server, but never completes the handshake. This leaves the server with a lot of half-open connections, consuming resources and potentially leading to a denial of service (DoS).
- Mitigation strategies include SYN cookies, increasing backlog queue size, and reducing the SYN-RECEIVED timer.

Application Layer ¶

Responsible for providing network services directly to end-users and applications.

Various protocols operate at this layer, including:

HTTP and HTTPS (we should be aware of the difference between them)
- These are the protocols used for web browsing.
TLS for CIA (Confidentiality, Integrity, Availability) TLS
- Provides encryption and secure communication over a network.
SSH (vs Telnet)
- Secure Shell (SSH) is a protocol for secure remote login and other secure network services over an insecure network. It encrypts the session, making it secure against eavesdropping, connection hijacking, and other attacks.
- Telnet, on the other hand, transmits data in plaintext, making it vulnerable to interception and attacks.
DNS (Domain Name System)
- Translates human-readable domain names (like www.example.com) into IP addresses that computers use to identify each other on the network.
DHCP (Dynamic Host Configuration Protocol)
- Automatically assigns IP addresses and other network configuration parameters to devices on a network, allowing them to communicate effectively.
Email: SMTP, IMAP, POP3
- SMTP (Simple Mail Transfer Protocol) is used for sending emails.
- IMAP (Internet Message Access Protocol) and POP3 (Post Office Protocol version 3) are used for retrieving emails from a mail server.
- POP3 downloads the email to the local device and usually deletes it from the server, while IMAP allows users to view and manage their emails directly on the server, keeping them synchronized across multiple devices.
File sharing/file transfer: FTP, SFTP, SMB
- FTP (File Transfer Protocol) is used for transferring files between a client and server on a network. It is not secure as it transmits data in plaintext.
- SFTP (SSH File Transfer Protocol) is a secure version of FTP that uses SSH to encrypt the data transfer.
- SMB (Server Message Block) is a network file sharing protocol that allows applications and users to read and write to files and request services from server programs in a computer network. It is commonly used in Windows environments.

Network Security¶

Firewall (packet filter)
- What the Firewall actually does is that it filters packets based on rules.
- The definition of a Firewall is: “A network security device that monitors and filters incoming and outgoing network traffic based on an organization’s previously established security policies.”
- It can block or allow traffic based on IP addresses, ports, protocols, etc.
VPN (Virtual Private Network)
- A VPN creates a secure, encrypted connection over a less secure network, such as the internet. It allows users to send and receive data as if their devices were directly connected to a private network.
- It provides confidentiality and integrity for data in transit.

Operating System¶

What is an OS?¶

Know the difference between the Kernel and user space.
Core functionality
- Abstracton from raw hardware interfaces. E.g., instead of having to know how to talk to a hard drive, you can just use file system calls.
- Arbitration / Resource management for multiple processes/users. Essentially deciding who gets to use what resources when.
- Process management / scheduling. Running multiple processes at the same time on the same CPU core.
- File systems. Managing how data is stored and retrieved on storage devices.
- Protection (kernel vs. user space, user A vs. user B, process X vs process Y). Making sure that processes and users can’t interfere with each other in unauthorized ways.
Trusted Computing Base (TCB)
- The TCB is the set of all hardware, software, and controls that are critical to a system’s security.
- It includes the OS kernel, security mechanisms, and any other components that enforce security policies.
- The TCB is responsible for maintaining the confidentiality, integrity, and availability of the system.
- The smaller the TCB, the easier it is to analyze and secure.
Logging (for intrustion detection and forensics)
- The OS should log security-relevant events, such as login attempts, file access, and system changes. These logs can be used for intrusion detection and forensic analysis in case of a security incident.

OS Security¶

Issues:

Memory Safety: Buffer Overflows.
- A Buffer Overflow occurs when a program writes more data to a buffer (a contiguous block of memory) than it can hold. This can overwrite adjacent memory, leading to unpredictable behavior, crashes, or security vulnerabilities.
- Attackers can exploit Buffer Overflows to inject malicious code into a program’s memory space, allowing them to take control of the program or system.
- Common mitigation techniques include bounds checking, stack canaries, and using safer programming languages.
Race conditions (in Access Control), e.g., TOCTOU
- Race conditions occur when the behavior of a program depends on the timing or sequence of uncontrollable events, such as the order in which threads are scheduled. This can lead to unexpected behavior and security vulnerabilities.
- TOCTOU (Time of Check to Time of Use) is a specific type of race condition where a resource is checked for a certain condition (e.g., access permissions) and then used later, but the condition may have changed in the meantime.
- Attackers can exploit TOCTOU vulnerabilities to gain unauthorized access to resources.
Command Injection
- Command injection is a security vulnerability that occurs when an attacker is able to execute arbitrary commands on a host Operating System via a vulnerable application. This typically happens when user input is not properly sanitized and is passed directly to a system shell or command interpreter.
- Attackers can exploit command injection vulnerabilities to gain unauthorized access, manipulate data, or compromise the system.
- Mitigation strategies include input validation, using parameterized queries, and avoiding the use of system shells for executing commands.
Privilege Escalation
- Privilege escalation is a security vulnerability that allows an attacker to gain elevated access to resources that are normally protected from an application or user. This can occur through various means, such as exploiting software vulnerabilities, misconfigurations, or weaknesses in access control mechanisms.
- There are two types of privilege escalation: vertical (gaining higher privileges, e.g., from user to admin) and horizontal (gaining access to resources of another user with the same privilege level).
- Common mitigation techniques include regular patching, proper access control, and using the principle of least privilege.
Rootkits
- A rootkit is a type of malicious software designed to gain unauthorized root or administrative access to a computer system while hiding its presence. Rootkits can modify system files, processes, and configurations to evade detection by traditional security measures.
- Attackers use rootkits to maintain persistent access to compromised systems, often for malicious purposes such as data theft, espionage, or launching further attacks.
- Detection and removal of rootkits can be challenging, and mitigation strategies include using specialized rootkit detection tools, maintaining up-to-date security software, and regularly monitoring system integrity. Important concepts:
User (and process) permissions
Root/Admin vs. User
SUID on Unix
- The SUID (Set User ID) is a special type of file permission in Unix and Linux operating systems that allows a user to execute a file with the permissions of the file owner, rather than the permissions of the user who is executing the file.
- This is commonly used for executable files that require elevated privileges to perform certain tasks, such as changing passwords or accessing system resources.
- While SUID can be useful, it also poses security risks if not managed properly, as it can potentially allow unauthorized users to gain elevated privileges.

Virtualization¶

Types¶

What types we need to know for the exam:

Different types:
- Hypervisor / Virtual Machine
- Container (e.g., Docker)
- Emulation
... offer different
- Isolation from each other,
- Separation from the host,
- Performance / cost.
Main security issues:
- VM/Container escape.
  - When an attacker manages to break out of a virtual machine or container and gain access to the host system or other virtual machines/containers running on the same host.
- Attacks on other containers/images on the same host (e.g., Side-Channel Attacks)

Binary Exploitation ¶

Buffer Overflow¶

We should understand what is a Buffer Overflow, and how it can be exploited. Writing in memory outside the designated buffer for the input.

It can be used to overwrite the return address of a function, so that when the function returns, it jumps to attacker-controlled code. So we can call functions that normally we wouldn’t be able to call, or use parameters that we normally wouldn’t be able to use.

Part of the difficulty for attackers however is that attackers have to know the exact memory addresses of the code they want to jump to.

Mitigation techniques¶

Executing code via buffer overflow is made more difficult by modern mitigations such as ASLR (Address Space Layout Randomization), which randomizes the memory addresses of key data areas of a process, making it harder for attackers to predict where their malicious code will be located.

Stack Canaries are another mitigation technique, which involves placing a small, known value (the canary) before the return address on the stack. If a buffer overflow occurs and overwrites the return address, it will also overwrite the canary. Before returning from the function, the program checks if the canary value has changed; if it has, the program knows that a buffer overflow has occurred and can take appropriate action (such as terminating the program) to prevent exploitation.

Web Security¶

Attack Surface¶

Server-Side:

Visible Inputs (Forms, File Uploads)
Hidden Inputs (URL Parameters, HTTP Headers, Cookies)
API endpoints
Supply Chain
- The supply chain refers to all the libraries, frameworks, and third-party services that a web application depends on. Vulnerabilities in any of these components can introduce security risks to the application. Client-Side:
HTML, CSS, ... → DOM (Document Object Model)
- The DOM represents the structure of a web page and can be manipulated by scripts, which can introduce security risks such as Cross-Site Scripting (XSS) if not properly handled.
- Understanding the DOM is crucial for identifying potential vulnerabilities in web applications.
Client-Side Storage (Cookies, Access Tokens, ...)
- Client-side storage mechanisms can be exploited if sensitive data is not properly protected, leading to risks such as session hijacking or unauthorized access.
(Third-Party) Scripts
- Third-party scripts can introduce vulnerabilities if they are compromised or malicious, potentially leading to attacks such as data theft or unauthorized actions on behalf of the user.

Key Vulnerabilities¶

SQL Injection / SQLi
- SQL Injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It occurs when user input is improperly sanitized and is directly included in SQL queries. This can allow attackers to view, modify, or delete data in the database, as well as execute administrative operations.
- Mitigation: Common mitigation techniques include using prepared statements and parameterized queries, input validation, and employing least privilege principles for database access.
Insecure Direct Object References (IDOR)
- Insecure Direct Object References (IDOR) is a web security vulnerability that occurs when an application exposes a reference to an internal implementation object, such as a file, database record, or URL, without proper Access Control. This allows attackers to manipulate these references to gain unauthorized access to data or functionality.
- Example: An application that uses sequential numeric IDs in URLs (e.g., /user/123) without verifying the user’s authorization to access that resource.
- Mitigation: Mitigation strategies include implementing proper Access Controls, validating user input, and using indirect references
Broken Authentication (passwords, session ids, tokens)
- Broken Authentication refers to vulnerabilities in the authentication mechanisms of a web application that allow attackers to compromise user accounts or gain unauthorized access. This can occur due to weak password policies, session management flaws, or inadequate protection of authentication credentials.
- Mitigation: Mitigation techniques include implementing strong password policies, using multi-factor authentication, securely managing sessions, and regularly reviewing authentication mechanisms for vulnerabilities.
Cross-Site Scripting (XSS) ⇒ OWASP Top-Ten The main problem with “Vibe Coding” is that it encourages developers to write code quickly without actually understanding it or considering security implications.

AI¶

Attack Surfaces¶

Input Surface
User Prompts. Malicious users can craft prompts to manipulate the AI into generating harmful or unintended outputs.
Uploaded Documents. If the AI processes uploaded documents, attackers can embed malicious content to exploit vulnerabilities in the AI system.
Web Search results. If the AI uses web search results to inform its responses, attackers can manipulate search results to influence the AI’s output.
Attack Vectors: Prompt Injection, Jailbreaking.
Model Surface
Weights & Embeddings. Attackers can manipulate the model’s weights or embeddings to alter its behavior.
The neural network file. If attackers gain access to the model file, they can modify it to introduce vulnerabilities or change its functionality.
Attack Vectors: Extraction of (private) training data, Backdoors.
Agency Surface
Plugins, API calls, Code Execution. If the AI has access to external plugins, APIs, or can execute code, attackers can exploit these capabilities to perform malicious actions.
Attack Vectors: Confused deputies (tricking the model into doing something it has the ability to do, but shouldn’t)

AI-Enabled Cybercrime¶

GenAI lowers the barrier of entry for attackers.

Polymorphic Malware
Using LLMs to generate unique variants of malware that can evade traditional signature-based detection methods.
Social Engineering at Scale:
Phishing: Generating convincing phishing emails or messages tailored to specific targets.
Deepfakes: Creating realistic fake audio or video content to impersonate individuals for fraudulent
Vulnerability Discovery
Using AI to analyze software code and identify potential vulnerabilities more efficiently than traditional methods.

Societal Aspects¶

What is OSINT?¶

Should know what this is.

What is OPSEC (Operational Security)?¶

We should know: Why is this important? Why should you know this even if you don’t do anything illegal?

Phishing Website Detection¶