1. Today's Security Professional Flashcards
CIA Triangle
The 3 Key Objectives of Cybersecurity:
Confidentiality
Integrity
Availability
Confidentiality
Definition & Examples
Ensures that unauthorized individuals are not able to gain access to sensitive information.
Examples: Encryption, Firewalls, Access Control Lists.
Integrity
Definition & Examples
Ensures that there are no unauthorized modifications to information or systems, either intentionally or unintentionally.
Examples: Hashing, Integrity Monitoring Solutions.
Availability
Definition & Examples
Ensures that information and systems are ready to meet the needs of legitimate users at the time those users request them.
Examples: Backups, Clustering, Fault Tolerance.
DAD Triangle
The 3 Key Threats to Cybersecurity efforts:
Disclosure
Alteration
Denial
Technical Controls
Definition & Examples
Enforce CIA in the digital space.
Examples: Firewall rules, access control lists, IPS, and encryption.
Operational Controls
Definition & Examples
The processes that we put into place to manage technology in a secure manner.
Examples: Access Reviews, Log Monitoring, Vulnerability Management.
Managerial Controls
Definition & Examples
Procedural mechanisms that focus on the mechanics of the risk management process.
Examples: Periodic Risk Assessments, Security Planning Exercises.
Preventative Controls
Definition & Examples
Intend to stop a security issue before it occurs.
Examples: Firewalls, Encryption
Detective Controls
Definition & Examples
Identify security events that have already occurred.
Example: IDS
Corrective Controls
Definition & Examples
Remediate security issues that have already occurred.
Example: Restoring backups after a Ransomware attack.
Deterrent Controls
Definition & Examples
Seek to prevent an attacker from attempting to violate security policies.
Examples: Vicious Guard Dogs, Barbed wire fences.
Physical Controls
Definition & Examples
Security Controls that impact the physical world.
Examples: Fences, Perimeter Lighting, Locks, Burglar Alarms.
Compensating Controls
Definition & Examples
Controls designed to mitigate the risk associated with exceptions made to a security policy.
Example: Having to run an outdated version but putting it on a less important network to compensate.
DLP
Data Loss Prevention Systems:
Block data exfiltration attempts.
Help organizations enforce information handling policies and procedures to prevent data loss and theft.
Can Be: Host-Based DLP or Network DLP
