UNIX and Windows

1
UNIX and Windows

• Differences
• CLI vs GUI
• Root access vs SysAdmin
• UNIX privileges read, write, execute
• Windows privileges r,w,x, access, grant, create
  users
• Know the IA model well
• Availability what you need, when you need it
• Regulated by permissions not all users have the
  same availability

2
Security Models

• CIA
• IA
• Defense in Depth
• People, technology, operations
• People, passwords, permissions, patching,
  ports/protocols, policies
• Be able to describe the models in and of
  themselves, as how they relate to operating
  systems, applications, and network architectures

3
Architecture

• OSI Model
• Know the different layers within the network
  connection
• Defense in Depth DMZish stuff
• Know everything about a DMZ location,
  functionality, components diagrams
• In users, intranet router, internal web pages,
  VLANs, DHCP server, applications specific to
  business
• Middle DNS server, firewalls protecting
  inbound/outbound traffic
• Out internet router, World Wide Web
• Rule sets in firewalls protect components and
  their information
• Be able to relate the DMZ to the security models

4
Attacks

• Types
• Man-in-the-middle
• IP Spoofing
• Island Hopping
• SQL Injection
• XSS
• Privilege Escalation
• DoS

5
Panacea

• M-I-M
• Certificates (SSH, SSL, HTTPS, PKI)
• Concept of non-repudiation and authentication
• Island Hopping
• SQL XSS
• striptags
• Buffer Overflows
• Processor/Buffer
• Stack/Heap
• Assembly
• Manipulate pointer (via cmd) in Processor Stack
  to redirect line of code (use of NoOP)