I started my security training by taking a look at Googles venerable web application gruyere. Gruyere is available online and for download to run a local instance. The source code is written in python, and there are vulnerabilities within the source code and in the html. I started by going to code academy to get myself failure with python so I could read the source code with a small amount of understanding of the syntax. I went through most of the course looking for how methods are crated and called, how to make a class, and how variables are declared and their data type set. Going through the course about 1 hour at a time a couple times a week got me all the information I needed in about a week and a half.

 

After getting all the information I needed on python I downloaded the source code and got Gruyere set up on my computer. Once I was done with the setup I started my intro to CISSP book and videos.  

Intro to CISSP:

The first video I watched went over access control and Software development security. Access control cover one of the fundamental aspects of security called Availability. Meaning that if something is so secure that it is not available to the people that need it you are failing, but if everyone one has access to it you are still failing. Finding this happy medium is the basic idea behind access control. The more formal definition of Access Control is the ability to permit or deny the use of an object (a passive entity, such as a system or file) by a subject (an active entity, such as an individual or process).A subject is an active entity (such as an individual or process) that accesses or acts on an object. An object is a passive entity (such as a system or process) that a subject acts upon or accesses.

Access Control systems include:

·         File permissions, such as “create,” “read,” “edit,” or “delete” on a file server.

·         Program permissions, such as the right to execute a program on an application server.

·         Data rights, such as the right to retrieve or update information in a database.

There are several types of controls used to achieve access control:

·         Preventive controls, for reducing risk

·         Detective controls, for identifying violations and incidents

·         Corrective controls, for remedying violations and incidents and improving existing preventive and detective controls

·         Deterrent controls, for discouraging violations

·         Recovery controls, for restoring systems and information

·         Compensating controls, for providing alternative ways of achieving a task

Introduction

  This semester I will study cyber security through the lens of CISSP focusing on penetration and web tests. As I read through the CISSP book I will be working on programs like metaspliot and googles Gruyere. Reading and summarizing the CISSP book will allow me to get a good handle on corporate security from a conceptual perspective. Working hands on with metasploit and Gruyere will give me some technical experience in the domain. At the end of the semester I hope to have a good understanding of how security can impact an organization while Improving on my technical skills.