16 - Managing Security Operations Flashcards
What is Need-to-Know and Least Privilege?
- Need-to-Know Access: Grants users access to data or resources they need to perform assigned work tasks.
- Least Privilege: Subjects are only granted privileges necessary to perform assigned work tasks and no more.
- Entitlement: The amount of privileges granted to users, typically when first provisioning.
- Aggregation: The amount of privileges a user collects over time.
- Transitive Trust: A trust relationship between 2 security domains allows subjects in one domain (primary) to access objects in the other domain (training).
What is the Separation of Duties and Responsibilities?
- Ensures that no single person has total control over a critical function or system.
- Separation of Privilege: Applies granular rights to a user or process, only what is needed.
- Segregation of Duties: Ensures an individula does not have excessive rights on a system that can cause a conflict of interest.
- Two-Person Control (Two Man Rule): Requires the approval of two individuals for critical tasks.
What is Job Rotation?
aka Rotation of Duties, employees are rotated through jobs or job responsibilities which enables peer review, reduces fruad, and enables cross-training.
What are Mandatory Vacations?
Requires employees to take vactions in 1-2 week increments. This helps provide peer review and helps detect fraud when the employee is out.
What is Privileged Account Management?
Any type of privileged account or activity should be monitored such as:
- Accessing audit logs
- Changing system time
- configuring interfaces
- managing user accounts
- controlling system reboots
- backing up and restoring the system
- Configuring security controls
What is Managing Information Lifecycle?
Protecting data throughout each stage of its life:
- Creation or Capture
- Claffification
- Storage
- Usage
- Archive
- Destruction or Purging
What is an SLA?
A Service Level Agreement is an agreement between an organization and an outside entity, such as a vendor. Usually includes performance expectations and often inlcudes penalties if the vendor doesn’t meet these expectations.
What are some components of Personnel Safety & Security?
Organizations should implement security controls that enhance personnel safety because people can’t be replaced like other assets.
- Duress: Systems that can send a distress call.
-
Travel: Criminals can target an organization’s employees while traveling. Safe practices while traveling can prevent issues.
- Sensitive Data: Ideally, devices should not contain sensitive data but if they do, encryption should be used.
- Malware and Monitoring Devices: Malware and monitoring devices can be put on people’s devices while traveling. Best practices are generally keeping devices with you at all times or just taking a temporary device.
- Free Wi-Fi: Free Wi-Fi can be a trap to capture all’s traffic. If needed, user’s should create their own internet connection with a smartphone or mi-fi device.
- VPNs: Use VPN’s to create a secure connection.
- Emergency Management: Helps an organization address personnel safety and security after a disaster.
- Security Training and Awareness: Helps ensure that personnel are aware of duress systems, travel best practices, emergency management plans, and other best practices.
How do organizations Managing Hardware & Software Assets?
- Hardware Inventories: The use of database or inventory applications to perform inventories and track hardware assets.
- Software Licensing: The purchase of the right to use proprietary software on organization machines. Also the monitoring for unapproaved software on machines.
How do companies protect Physical Assets?
organizations generally put assets behind fences, barricades, locked doors, guards, etc. They also attempt to put data centers towards the middle of a buidling so they can put progressively more secure barriers as you towards the center.
What are some different components for Software Defined Everything (SDX)?
- Virtual Machines (VMs): Run as guest OSs on physical servers.
-
Virtual Desktop Infrastructure (VDI): aka Virtual desktop Environment (VDE), hosts a users desktop as a VM on a server.
- Persistent: Retains a custom desktop for the user.
- Nonpersistent: Desktops are identical for all users. Reverts to a known state after the user logs off.
- Software-Defined Networks (SDNs): Uses a SDN controller to handle traffic routing using simpler network devices that accept instructions from the controller.
- Virtual Storage Area Networks (VSANs): A virtual high speed network that hosts multiple storage devices.
What are the different service levels of Cloud based solutions?
- Software-as-a-Service (SaaS): Fully functional applications typically via a web browser.
- Platform-as-a-Service (PaaS): Provides a computing platform, including hardware, an OS, and applications.
- Infrastructure-as-a-Service (IaaS): Provides basic computing resources to consumers including servers, storage, and networking resources.
What are the different Cloud models available?
- Public Cloud: Assets available for any consumers to rent or lease and is hosted by an external CSP.
- Private Cloud: Cloud-based assets for a single organization.
- Community Cloud: Provides cloud based assets to two or more organizations.
- Hybrid Cloud: Includes a combination of tow or more clouds.
What is Media Management?
The steps taken to protect media and the data stored on it. Media can be anything that can hold data such as tapes, optical media such as CDs and DVDs, USB drives, eSATA, SSDs, and flash drives.
Media should be stored in a secure location with controlled access and climate control.
Media management can also include technical controls such as restricting device access from a computer system.
What is Tape Media management?
- Tape media is generally saved in 2 copies: 1 offsite and 1 onsite.
- Tape media needs to kep away from magnetic fileds as it will wipe the data.
- Maintain climate (avoid outside exposure)
- keep in original packaging until needed
- Consider encrypting the data
