BSIT380-T302

We are already passing week 7, over halfway complete. Within Chapter 11 a topic that jumped out to me was the use of Digital Signatures, they are created using private and public cryptographic keys. With the implementation of Digital Signatures it ensures that non-wet signatures can be verified based on a key or token that only the individual should have access to. In the US Department of Defense they issue all military members CAC or common access cards, they have a certificate that is references via a programmable chip on a card. This card is used to gain access to military bases and restricted areas, they are also configured with Active Directory. In AD the user would plug in the card (something that you have) and enter a pin (something that you know) covering two bases of security ensuring multifactor authentication. 

 Disasters are bound to happen given enough time, and the best way to prepare is to create a plan and inform those whose skill sets will be needed during and after the disaster. A Disaster recovery plan or DRP for short is exactly that! A DRP should include being created with the following information in the following order, Title and last revised date, and members of the committee with primary and secondary contact info. The members of the committee should include at least one c level executive, multiple members from the IT software and hardware team, and the communications and public affairs team. The first chapter will discuss a delegated meeting location if the primary facility is ruined or unable to be met. The next few chapters should include a list of all assets and employee contact info, where to locate insurance information, and what order of communications should be created first. Lastly, the ending should include anything else that pertains to the type of industry such a...

 Withing chapter nine there is many items that stood out to me, most interesting to me was reverse engineering. Reverse engineering is a method that is used to "undo" a completed software, program, or virus to see what is under the hood. The goal is to reverse the steps taken during the creation of the original program. Many security engineers are required to know the basics of programs and how it relates to the OSI model. The first hurle is to replicate the software in a safe environment  if the software is unrepariable the environment can be reverted to the previous compiled state. When I was working at a former employer we were a target for a phishing scam, after downloading the email and disconnecting the device from the primary network we were able to put on a private network and Wireshark. The traffic was pinpointed and an attack was blocked based on the return address and port. 

SIEM is a system whose goal is to collect and centralize information from multiple systems to give a “heart beat” or the overall status of the network and security posture. When a security information and event management system or SIEM is setup the data should always be one-way traffic in UDP format, if each SIEM had direct access to each system this could cause a whole new security vulnerability from a system designed to protect a network. SIEM uses multiple input sources and types of data depending on the centralized system, some of the protocols that are used are as follows: SysLog, SNMP, NetFlow, Windows Event Log and Common Event Format(CEF) . Any company that uses multiple systems that are hard to keep track of or hard to keep eyes on a SIEM should be implemented, from basic network load to servers that are pegged due to a DDoS attack, SIEMs can help administrators see more info in a domain.

 This week’s blog will cover week 3 for BSIT380, within this week IDS and IPS were covered on how they work and are different from each other. IPS or Intrusion Protection System will locate traffic and will use predefined rules to try to block or redirect attacks to a DMZ. With IDS or Intrusion Detection System an alert goes off and the alert is typically passed to either a log or a person, a IDS works best when manual intervention is typically required or in test environments to just get a better picture of the network. In chapter 6 host-based security was covered as well as device hardening, patch management, antivirus, anti-malware, and HIDS. With anything when it comes to changes it is a good idea to log and set a procedure for said changes. 

  Network security is a growing concern for organizations of all sizes as attackers become more sophisticated and determined to get into a restricted network . While virtual ized and appliance-based tools can provide security for most applications and services , it is important to remember that no single tool can protect against all known threats . It is essential that organizations have a multi-layer security plan that is tested and checked annually. Networks that is deemed secured should still include regular monitoring , management , and updates . This week 's chapters provide an excellent overview of the tools and policies needed to respond to potential network security threats . It is important to remember , t hat security is an ongoing process and regular updates to tools and policies are necessary in order continuously secure an organization 's structure network . With the ...

 Hello! My name is Jake and I am a transfer student from Southeast Tech located in Sioux Falls, SD. I have my associates in IT security and am interested in going further with Bellevue. I have worked with system hardening during my time in the US Department of Defense as a Cyber Systems Operator and a Cyber Defense Operator. During my time in the Air Force, I worked with a program called Stigs and stig viewers. https://public.cyber.mil/stigs/srg-stig-tools/ is a good site to see what the US DoD thinks is a vulnerability and should be changed, the list is not all-encompassing to prevent attackers from knowing what systems were changed and what portion was changed.  I am eager to get started and share what lessons I will learn this semester.