Skip to main content

CEH v10: 01 Introduction

Certified Ethical Hacker v10 Chapter 01: Introduction

Essential Terminologies

Hack Value: A notion among hackers that something is worth doing or is interesting.

Vulnerability: Existence of a weakness, design, or implementation error that can lead to an unexpected event compromising the security of the system.

Exploit: A breach of IT system security through vulnerabilities.

Payload: Payload is the part of an exploit code that performs the intended malicious action, such as destroying, creating backdoors, and hijacking computer.

Zero-Day Attack: An attack that exploits computer application vulnerabilities before the software developer releases a patch for the vulnerability.

Daisy Chaining: It involves gaining access to one network and/or computer and then using the same information to gain access to multiple networks and computers that contain desirable information.

Doxing: Publishing personally identifiable information about an individual collected from publicly available databases and social media.

Bot: A "bot" is a software application that can be controlled remotely to execute or automate predefined tasks.

Information Security​

The information security is a state of well-being of information and infrastructure in which the possibility of theft, tampering , and disruption of information and services is kept low or tolerable.

Elements of Information Security​

CIA triad​

Confidentiality: Assurance that the information is accessible only to those authorized to have access.

Integrity: The trustworthiness of data or resource in terms of preventing improper and unauthorized changes.

Availability: Assurance that the systems responsible for delivering, storing, and processing information are accessible when required by the authorized users.

Other​

Authenticity: Authenticity refers to the characteristic of a communication, document or any data that ensures the quality of being genuine.

Non-Repudiation: Guarantee that the sender of a message cannot later deny having sent the message and that the recipient cannot deny having received the message.

The Security, Functionality, and Usability triangle​

Security: Restrictions imposed on accessing the components of the system (restrictions).

Functionality: The set of features provided by the system (features).

Usability: The GUI components used to design the system for ease of use (GUI).

Information Security Attacks and Attack Vectors​

Attacks = Motive (Goal) + Method + Vulnerability

A motive originates out of the notion that the target system stores or process something valuable and this leads to threat of an attack on the system

Attackers try various tools and attacks techniques to exploit vulnerabilities in a computer system or security policy and controls to achieve their motives

Motives behind attacks:​

  • Disrupting business continuity
  • Information theft and manipulating data
  • Creating fear and chaos by disrupting critical infrastructures
  • Financial loss to the target
  • Propagating religious or political beliefs
  • Achieving state's military objectives
  • Demanding reputation of the target
  • Taking revenge
  • Demanding ransom

Top InfoSec Threats​

  • Cloud Computing Threat
  • Advanced Persistent Threats (APT): stealing information from the victim machine without the user being aware of it
  • Viruses and Worms
  • Ransomware
  • Mobile Threats

Top InfoSec vectors:​

  • Botnet
  • Insider Attack
  • Phishing
  • Web Application Threat
  • IoT Threats

InfoSec Threats categories:​

  • Network Threats (spoofing, sniffing, ...)
  • Host Threats (malware, dos, ...)
  • Application Threats (auth attacks, SQL injection, ...)

Type of Attacks on a System:​

  • Operating System Attacks (OS vulnerabilities)
  • Misconfiguration Attacks
  • Application-Level Attacks (exploit the application)
  • Shrink-Wrap Code Attacks (exploit the common vulnerable libraries)

ICT : Information and Communication Technologies