Chapter 1 - Mastering Security Basics Flashcards
Availability
Indicates that data and services are available when needed
Redundancy
Adds duplication to critical system and provides fault tolerance so if a critical component has a fault, the redundancy allows the service to continue without interruption.
-Disk redundancies (RAID)
-Server redundancies (virtualization can help)
-Network redundancies (NIC teaming)
-Power redundancies (UPS)
Scalability and elasticity
Both contribute to high availability
Scalability refers to the ability of a system to handle increasing workload or demand by adding resources such as processing power, memory, or storage capacity. It measures how well a system can accommodate growth without sacrificing performance or efficiency.
Elasticity refers to the ability of a system to automatically or dynamically adapt to changing workload or demand by provisioning or releasing resources as needed. It involves scaling resources up or down based on demand in a flexible and automated manner. Often described in regards to cloud computing.
Scalability focuses on the ability of a system to handle growth by adding resources in a proactive manner, whereas elasticity focuses on the dynamic and automated adjustment of resources in response to changing demand.
Resiliency
The ability for systems to heal themselves or recover from faults with minimal downtime.
-Performing and testing full backups
-Backup power sources (UPS, generators)
-NIC teaming
-Redundant disk subsystems
Managerial controls
Managerial controls are primarily administrative in function, typically documented in an organization’s security policy and focus on managing risk.
Two common managerial controls are:
-Risk assessments
-Vulnerability assessments
Operational controls
Help ensure that the day-to-day operations of an organization comply with the security policy. People implement and execute them.
Operational controls include:
- Awareness and training
-Configuration management.
Baselines to ensure that systems start in a secure, hardened state.
-Media protection.
Physical media like USB flash drives, external and internal drives, and backup tapes
-Physical and environmental protection
Includes physical controls such as cameras, door locks, and environmental controls such as heating and ventilation systems.
Types of Security Controls
Security controls are categorized as managerial (documented in written policies), operational (performed in day to day operations), or technical (implemented with technology).
Technical Controls
Technical controls use technology such as hardware, software and firmware to reduce vulnerabilities.
Some examples include:
-Encryption
-Antivirus software
-IDS and IPS
-Firewalls
-Least privilege principle
Physical controls and environmental controls
Include motion detectors and fire suppression systems.
Preventative controls
The primary goal of preventative controls is to prevent security incidents, some examples including:
-Hardening
-Training
-Security guards
-Change management (help prevent outages from configuration changes)
-Account disablement policy
-IPS
Detective controls
Attempt to detect when vulnerabilities have been exploited, resulting in a security incident. Detective controls discover the event after it has occurred. Examples include:
-Log monitoring
-SIEM systems (detect trends and raise alerts in real time)
-Security audit
-Video surveillance
-IDS
Corrective and recovery controls
Attempt to reverse the impact of an incident or problem after it has occurred.
-Backups and system recovery
-Incident handling process
Physical controls
Any controls you can physically touch:
-Bollards and barricades
-Access control vestibules
-Lighting
-Signs, fences, sensors and more
Can be multiple control types, ie locks are physical, deterrent and preventative
Deterrent controls
Attempt to discourage a threat, to discourage potential attackers from attacking and from employees from violating a security policy
Deterrent and preventative often overlap
-Security guard
-Cable locks
-Physical locks
Compensating controls
Alternative controls used instead of a primary control, such as requiring employees to use smart cards when authenticating on a system, but allowing new employees to access the network using a TOTP while their smart card gets made.
Response controls
Commonly referred to as incident response controls, are controls designed to prepare for security incidents and respond to them once they occur; usually started by creating security policies then training personnel on how to respond to incidents.
