HTTPS Process

When studying for the CompTIA Security+ exam, you'll come across some cryptography objectives.  One thing that confuses many people is how SSL works with HTTPS.

I've broken it down to the following steps with a diagram at the end that may help you understand it a little better.

1. The client starts the HTTPS session by clicking on the link.
2. The server responds by sending a certificate. The certificate includes the server's public key that is part of a matched private/public key pair. The private key is always kept private by the server.
3. The client creates a random session key (such as 13579BDF2468ACE).
4. The client encrypts the session key with the server's public key.
5. The client then sends the encrypted session key to the server.
6. The server then decrypts the session key with the server's private key.
7. Rest of session uses symmetric session key.

Question:  What type of encryption does SSL use to privately share the session key? 
Answer: Asymmetric

Question: What type of encryption does SSL use to encrypt the session data?
Answer: Symmetric

Trick Question: What type of encryption does SSL use ?

Answer: Asymmetric and symmetric

You can find more details on cryptography in this chapter 9 of this book:
CompTIA Security+: Get Certified Get Ahead: SY0-201 Study Guide

You can also watch a video on YouTube here:
SSL Asymmetric and symmetric encryption

HTH,

Darril Gibson

Biometrics False Positive False Acceptance

I'm teaching a Security+ class this week and this topic came up again.  Here's some clarification...

Biometrics is used for authentication.  It is in the "something you are" factor. You can read about the three factors of authentication here.

However, biometrics can be calibrated for different levels of accuracy.  Two types of errors are possible.

• False acceptance or false positive. This is when a system inaccurately identifies someone as someone else.  For example, imagine that Attacker Al steals Sally's laptop. The laptop has a fingerprint scanner for authentication with Sally's fingerprint .  Attacker Al tries his fingerprint and it works.  It accepts his fingerprint even though it shouldn't. It returns a positive match as though his fingerprint is the same as Sally's even though this is obviously false.
• False rejection or false negative. Now imagine that Sally has the same laptop.  She has registered her fingerprint on the system.  The next day she tries to use this for authentication. Unfortunately, the system rejects her fingerprint. It returns a negative match as though Sally's fingerprint isn't actually her finger even though it's the same finger she used the day before.

The confusion with some people is realizing that false acceptance is the same as false positive, and false rejection is the same false negative. 

Think about this.  The PoweBall lottery in the U.S. wants to give you a million dollars for your winning ticket. Do you accept it?  You'll probably answer with a positive answer such as Yes, or Absolutely.  Accept is a positive response.  On the other hand, reject is a negative answer.  Someone may say No they don't want the money (though I can't imagine why not). The rejection with a No is a negative response.

You can overthink this, but it's as simply as acceptance is positive, and rejection is negative.

Interestingly, both terms are simplified.  Biometrics more technically use the following terms:

• False reject rate (FRR).  This is commonly referred to as a Type I error, or a false rejection error.
• False accept rate (FAR). This is commonly referred to as a Type II error, or a false acceptance error.
• Crossover error rate (CER). This is a measurement betwee then the FRR and FAR represented as a number or a percentage.  The lower the number or percentage, the more accurate the biometrics system is.  For example, a  CER of 2 (or 2 percent) is much better than a CER of 10 (or 10 percent).

Here's an interesting article that explains FRR, FFAR, and CER. It's a CISSP study article and digs a little deeper into the topic than necessary for Security+ but may help clarify things for you.

Good luck with your studies.

Darril Gibson

YouTube Videos

After teaching a Security+ class this week, I decided to create a few videos for the cryptography topics. I created them in Camtasia and posted them on YouTube. You can view them here:

Security+ Encryption and the Rayburn box


Digital Signatures

SSL Asymmetric and symmetric encryption

Hashing and integrity


Darril Gibson

A Twist on the MP3 Study Method

Years ago, a student told me of method he used to study for certification exams.  This blog entry talks about it. In short, you can read study material into an MP3 recorder.  Whenever you have the chance, you listen to the recordings. Since MP3s are so portable you can listen to the recording just about anywhere.

As a twist, someone recently told me they had their girlfriend record the material. He liked hearing her voice more than his own. Think about your girlfriend or boyfriend saying in their most sultry voice "Integrity is used to verify that data has not been modified." It sounds like a great idea. 

I guess the only danger is that when someone starts talking to you about security issues you may remember the voice and get a little excited.  But is that such a bad thing?

Good luck with your studies.

Darril Gibson
CompTIA Security+: Get Certified Get Ahead: SY0-201 Study Guide

Practice Question Virus Infection

A computer is infected with a virus.  The installed antivirus software didn't detect the problem.  What would be the first action to take?


  A. Notify an administrator

  B. Install new antivirus software
  C. Update the antivirus signature files
  D. Contain the problem.


Answer below.









Over 375 practice test questions in this book:













CompTIA Security+: Get Certified Get Ahead: SY0-201 Study Guide


List of  Security+ Blogs
List of Security+ Questions


Answer: D. The first step in response to an incident to contain or isolate the problem. This can often be done by simply pulling the cable on the NIC. Notification should be done after containment, but policy would often dictate the notification of someone on an incident response team. Ensuring that a system has antivirus software and updated signature files are good steps to take, but not as a first step after an infection. You’d still want to contain the problem to a single system before installing the software and updating definitions.

This question is related to objective:
6.3 Differentiate between and execute appropriate incident response procedures.

• Damage and loss control

Incident Response Practice Question

What documentation is needed to verify that the evidence collected is the same evidence that is presented in court?

  A. Affidavit of evidence
  B. Chain of custody
  C. Chain of forensics
  D. Access authorization

Answer below.

Over 375 practice test questions in this book:














CompTIA Security+: Get Certified Get Ahead: SY0-201 Study Guide







Answer: B. A chain of custody verifies that evidence presented in court is the same evidence that was collected; a chain of custody should be established when seizing any evidence. The other documents listed won’t take the place of chain of custody documentation.

This question is related to objective :

   6.3 Differentiate between and execute appropriate incident response procedures.

• Chain of custody

Least Privilege

When studying for the CompTIA Security+ (SY0-201) exam, you'll come across this objective.

3.1 Identify and apply industry best practices for access control methods.

One of the praactices you should understand is: Least Privilege.

The principle of least privilege specifies that individuals or processes should be granted only the rights needed to perform assigned tasks or functions, but no more. For example, if Sally needs to print to a printer, you should grant her print permission for that printer but nothing else.
There's a subtle difference between Least Privilege and Need to Know.  Least Privilege focuses on rights or actions.  Need to Know focuses on permissions or access to data.

Good luck with your studies.

Darril Gibson
CompTIA Security+: Get Certified Get Ahead: SY0-201 Study Guide