Unit 4: Securing Devices

Devices include servers, personal computers, handheld devices and embedded computers built into machines (everyday ones are often called IoT devices). Malware comes in many forms: viruses, worms, trojans and remote access trojans (RATs), ransomware, spyware, keyloggers, logic bombs, rootkits and fileless malware. Attackers get in through unpatched software, weak passwords, a BIOS or UEFI with no password, autorun on external drives, open ports, and missing firewalls or anti-malware.

Systems store a hash of your password, not the password itself. A good cryptographic hash is fixed-length and repeatable and hard to reverse or collide (MD5 and SHA-1 are no longer considered safe), and a unique salt makes identical passwords hash differently. Online attacks hit a login page (password spraying, or credential stuffing with stolen or default logins), while offline attacks guess against a stolen hash database (brute force, dictionary and rainbow tables). Systems fight back by combining authentication factors (something you know, have or are, or somewhere you are) and enforcing password complexity, length, history and lockout settings.

Policies set the rules for devices: an acceptable use policy, a password policy and a software installation policy. Anti-malware software scans files against a database of malware signatures and quarantines matches, and updates and patches close known holes. A host-based firewall uses ordered rules to block ports and services the device doesn't need, including outbound traffic an attacker could use to sneak data out.

Devices log logins, file activity, settings changes and running processes. Those logs hold indicators of compromise, such as many failed logins, logins at odd times or places, unexpected files or software, and files whose hashes match known malware. In an auth log, many wrong passwords for one user suggest an online password attack, many users tried from one IP address within seconds suggest password spraying, and a quick run of default username and password pairs suggests credential stuffing.