Chapter 1 - Security Governance Through Principles and Policies Flashcards
What does CIA stand for?
Confidentiality, Integrity and Availability
What does DAD stand for?
Disclosure, alteration, and destruction
Concepts to assess confidentiality
Sensitivity,
Discretion,
criticality,
concealment,
secrecy,
privacy,
seclusion,
isolation
Sensitivity
Quality of information, which could cause harm or damage if disclosed
Discretion
Act of decision where an operator can influence or control disclosure in order to minimize harm or damage
Criticality
Level of which information is missin critical is its measure of criticality. The. higher the level the more likly to maintain higher confidentiality
Concealment
Act of hiding or preventing disclosure
Secrecy
Acto of keeping something a secret or preventing the disclosure of information
Privacy
Refers to keeping information confidential
Seclusion
Involves storing in an out of the way location
Isolation
Act of keeping something separated from others
Integrity
Dependent on confidentiality and access control - Concepts include Accuracy, Truthfulness, Validity, Accountability, Responsibility, Completeness, Comprehensiveness
AAA Services
Identification, Authentication, Authorization, Auditing, Accounting
Defense in Depth
Also known as LAYERING. Is the use of multiple controls in a series. No one control can protects against all possible threats.
Abstraction
Used for efficiency. Similar elements are put into groups, classes, or roles.
Data Hiding
Preventing data from being discovered by positioning in a logical storage compartment that is not accessible or seen
Security through obscurity
Idea of not informing a subject about an object being present and hoping will not be discovered
Security governance
Collection of practices related to supporting, evaluating, defining, and directing the security efforts of an organization
Who is responsible for security governance?
Board of directors, CEO, CISO.
ATO
Authorization to operate. Failing to provide sufficient documentation to meet requirements of third party governance can result in loss of ATO.
Security Management Planning
Ensures creation, implementation and enforcement of a security policy. Aligns security functions to the strategy, goals, mission, and objectives of the organization.
COBIT 5 Principles
Created by ISACA, COBIT allows practitioners to govern and manage IT
framework help organizations optimize their IT management and governance processes by meeting contractual agreements and complying with the latest regulatory and legal requirements.
-meeting stakeholder needs,
-covering the enterprise end-to-end,
-applying a single integrated framework,
-enabling a holistic approach,
-and separating governance from management
AUP
Acceptable Use Policy defines what is and what is not acceptable activity practice or use of company equipment and resources.
Collusion
When several people work together to perpetrate a crime
What is important when addressing Multiparty Risk
When several entities or organizations are involved in a project use SLAs to address risks.
Risk Conceptual Formula
risk = Threat * Vulnerability or
risk = probability of harm * severity of harm
Six Elements of Quantitative Risk Analysis
1) Asset Vauation (AV)
2) Exposure Factor (EF)
3) Single Loss Expectancy (SLE)
4) Annualize Rate of Occurence (ARO)
5) Annualized Loss Expectancy (ALE)
6) Cost Benefit Analysis of countermeasures
Exposure Factor (EF)
% of loss that an organization would experience if a specific asset is violated by a realized risk
Single Loss Expectancy (SLE)
Potential loss associated with a single relaized threat against a specific asset
SLE = AV * EF
SLE is expressed in $$
Annualized Rate of Occurrence (ARO)
Expected frequency a specific threat or risk will occur per year
Annualized Loss Expectancy (ALE)
ALE = SLE * ARO
ALE = AV * EF * ARO
Risk Reponse
Mitigation or Reduction
Assignment or Transfer
Deterrence
Avoidance
Acceptance
Reject or Ignore
Total Risk
Total Risk = threats * vulnerabilities * asset value
Controls Gap
Controls Gap = Total Risk - Residual Risk
Controls Gap is the amount of risk that is reduced by implementing safeguards
ACS
Annual Cost to Safeguard
STRIDE
The STRIDE threat model is a developer-focused model to identify and classify threats under 6 types of attacks
Spoofing,
Tampering,
Repudiation,
Information Disclosure,
Denial of Service,
Elevation of Priviledges
To identify threats and vulnerabilities
And develop countermeasures
Potential Annual Cost of a Safeguard
Cost/Benefit Calculation or Analysis
[ALE Pre-Safeguard - ALE Post-Safeguard] - Annual Cost of Safeguard ACS =
Value of the safeguard to the company
Negative is Bad, Positive is Good
Types of Security Controls
Preventive
Deterrent
Detective
Compensating
Corrective
Recovery
DIrective
Preventive Controls
Deployed to thwart or stop unwanted or unathorized activity
Deterrent
Discourage security policy violations
Detective
Deployed to discover or detect unwanted or unauthorized activity
Compensating
deployed to provide various options to other existing controls to aid in enforcement and support of security policies
Corrective
Modifies the environment to return systems to normal after an unwanted or unauthorized activity has occurred
Recovery
Extension to corrective controls but have more advanced or complex activities. Looks to repair or restore resources, functions, and capabilities after a security policy violation.
Directive
Deployed to direct, confine, or control actions of subjects to force or encourage compliance with security policies.
Computer Fraud and Abuse Act
Amendment to The first major piece of US cybercribe -specific legislation. 1986
To address hacking with penalties
Federal Sentencing Guidelines
Provided punishment guidelines to help federal judges interpret computer crime laws
Federal Information Security Management Act (FISMA)
Required a formal Infosec operations for federal government
Copyright and the Digital Millennium Copyright Act
Covers literary, musical, and dramatic works. DMCA prohibits the circuvention of copy protection mechanisms placed in digital media and limits the liability of the internet service providers for the activities of their users.
Security Control Assessment (SCA)
Formal evaluation of a security infrastructure individual mechanisms against a baseline or reliability expectation.
RMM
Risk Maturity Model - Assess keyindicators and activities or a mature, sustainable, and repeatable risk management process
RMF
Risk Management Framework.
NIST RMF in SP 800-37 establishes mandatory security requirements for federal agencies.
What are the six cyclical phases of NIST RMF?
Prepare
Categorize
Select
Implement
Assess
Authorize
Monitor
Whaling
Type of spear phishing targeted at high value individuals
Smishing
SPam over instant messaging.
VIshing
Phishing over telephony or voice comm systems
Spoofed email
email with falsified source address. DMARC is used to filter spoofed messages
Hoax
Form of social engineering designed to convince targets to perform an action that will cause problems or reduce IT security
BCP
Business Continuity Planning - Four main steps 1) Project Scope and Planning, 2) Business impact analysis, 3) Continuity Planning, 4) Approval and implementation
BC and DR Terms
MTD - Max tolerable downtime
RTO
RPO
ARO - Annualized Rate of Occurence
BCP
Focuses on the whole business
DRP
Focuses on technical aspects of recovery
Criminal Law
Serve to protect society against computer crimes.
Civil Law
Provide for an orderly sociatey and governs matters that are not crimes but require an impartial arbiter to settle dispute.
Administrative Law
Executive brand of the US government that requires agencies with a wide ranging set of responsibilites to ensure the government functions effectively
Computer Fraud and Abuse Act (CFAA)
First major piece of cybercrime specific legislation. Covers computer crimes that cross state boundaries to avoid infringing on state rights. CFAA was amended in 1994.
National Information Infrastructure Protection Act of 1996
Another amendement to CFAA designed to further extend to computer systems used in international commerce.
FISMA - Federal Information Security Management Act
Passed in 2002. Requires federal agencies to implement an information security program to cover agency’s operations. Includes contractor activities.
NIST - National Institute of Standards and Technology is responsible for developing the implementation guidelines.
1) Periodic assessment of risk
2) Establish policies and procedures based on the risk assessments
3) Subordinate plans for adequate info security for networks, facilites, info systems, etc
4) Security awareness training
5) Periodic testing and evaluation
6) Process for planning, implementing, evaluating, and documenting remedial actions
7) Procedures for detecting, reporting, and responding to security incidents
8) Plans and procedures to ensure continuity of opertions for information systems
Federal Cybersecurity Laws of 2014
By President Barack Obama
2 key bills:
1) Federal Info Systems Modernization Act (confusingly FISMA) - Centralized federal cybersecurity under Homeland Security. Excludes defense related and national intelligence related cybersecurity issues.
2) Cybersecurity Enhancement Act - charges NIST with responsibility for coordinating nationwide work on voluntary cybersecurity standards. (i.e. NIST SP 800-53, SP 800-171, Cybersecurity Framework)
3) National Cybersecurity Protection Act - charged the Dept of Homeland Security with establishing a national cybersecurity and communication integrations center. Interface between federat agencies with civilian orgs to share cyber information.
Copyright Law
Guarantees creators of original work of authorship - protect against duplication
Literary, Musical, Drama, Patomimes, Pictorical, Movies, sound, architectural works
For computers it is the source code
Protection period - works by one or more authors are protected 70 years after the last surviving author. Works for hire and anonymous works are provided protection for 95 years from the date of first publication or 120 years from the date of creation, which ever is shorter.
Digital Millenium Copyright Act (DMCA)
- Limited the liability of internet service providers when their circuits were used by criminals to violate copyright laws.
Trademark
Protects words, slogas, and logos used to identify a company, products and services
Patents
Protect intellectual property rights of inventors. 20 year period from the time of the invention (date of initial application)
Trade Secrets
Not published or made public. Kept a secret and control measure must be put in place.
Four Common Types of License Agreements
Contractual
Shrink Wrap
Click Through
Cloud Services (click through to the extreme)
ITAR - International Traffic in Arms Regulations
Controls exports of items that are specifically designated as military and defense items including technical inforation.
EAR - Export Administration Regulations
Covers export regulations of a broader set of items that are designated for commercial use but have military application.
BIS - Dept of Commerce Bureau of Industry and Security
Regulates export of encryption products
Privacy Act of 1974
Limits the ability of federal government agencies to disclose private citizen information without prior written consent. Mandates agencies to maintain only records necessary for conducting business. Destroy records no longer needed. Provides formal procedure for individuals to gain access to their data and request incorrect records to be amended.
Only applies to government agencies
ECPA - Electronic Communications Privacy Act - 1986
Makes it a crime to invade electronic privacy of an individual. Expands on the Federal Wiretap Act. Protects against the monitoring of email and voice mail communic
CALEA - Communications Assistance for Law Enforcement of 1994
Amend ECPA to allow wiretaps for law enforcement with an appropriate court order regardless of technology use.
Economic Espionage Act of 1996
Extends definition of property to include proprietary economic information
HIPAA - Health Insurance Portability and Accountability Act of 1996
Established strict security measures to protect patient medical records in terms on how it is processed and stored. It also clearly defines the rights of individuals who are the subject of medical records and requires organizations that maintain such records to disclose these rights in writing.
HITECH - Health Information Technology for Economic and Clinical Health Act of 2009
Amendment to HIPAA. Changed how the law applies to business associates, which are orgs that handle the protected PHI data from HIPAA covered entities. Covered entities and BAs must be governed by a written contract know as the BAA agreement. BAs are subject to HIPAA rules. HITECH also introduced data breach notification requirements. Breaches must notify individuals as well as the secretary of heal and human services and the media - breaches must affect more than 500 individuals.
COPPA - Children’s Online Privacy Protection Act of 1998
COPPA demands websites that cater to children to have
1) Privacy notice that states the type of information collected and what its used for
2) Parents must have the opportunity to review any info collected and have the ability to delete
3) Parents must give verifiable consent to collect info for 13 and younger
Gramm Leach Bliley Act of 1999 - GLBA
Allowed commercial banks, investment banks, securities firms, and insurance companies were allowed to consolidate. Set limitations on the type of info that can be exchanged among subsidiaries and required the provision of privacy policies to all customers.
USA PATRIOT Act of 2001
Providing Appropriate Tools Required to Intercept and Obstruct Terrorism..
Broadened powers of law enforcement when monitoring electronic communications.
Chnaged how government worked with ISPs. Can obtain user activity data via subpoena.
EU GDPR - General Data Protection Regulation
Key Provisions
-Lawfulness, Fairness and transparency
-Purpose Limitation
-Data Minimization
-Accuracy
-Storage Limitation - “right to be forgotten”
-Security
-Accountability
Sensitive Data
Any information that is not public or unclassified. PII, PHI, Proprietary
Government Data Classification
Top Secret, Secret, Confidential, Unclassified
Non Governmental Data Classification
No set standard. Typical, Confidential/Proprietary, Private, Sensitive, Public
Data States
Data at rest, in Transit, in use
What are “air gaps”
A physical security control and means that systems and cables from the classified network never physically touch those from unclassified.
DLP
Data Loss Prevention
1) Network Based - scans all outgoing data. Placed on edge of network.
2) End Point - scans files stored on a system as well as files sent to other systems.
Data Remanence
Is the data that remains on media after the data was supposedly erased.
Degaussers can be used to erase data on magnetic media only
For SSD must be destroyed
Data Erasing
Only removes the directory or catalog link to the data. The actual data remains on the drive and over time slowly re written.
Clearing Data
Or overwriting. Unclassified data is written over all addressable locations on the media. Example single character or bit pattern is writtne over the entire media. May still be possible to retrieve data using sophisticated lab or forensic techniques
Purging Data
More intense clearing process. Multiple clearing passess. Combines with degausing. Not trusted by the US government.
Degaussing
USe of strong magnetic field to erase media. Does not work with optical CDs, DVDs or SSDs
Crytographic Erasure
Destruction of the encryption key. For cloud this may be the only method or secure deletion.
Digital Rights Management (DRM)
Data protection method to provide copy right protection for copyrighted works.
DRM License
Typically a small file that includes a terms of use and decryption key to grant access
Persistent Online Authentication - Always ON DRM
Requires systems to be connected to the internet. Periodically connects to authentication server.
Continuous Audit Trail
Combined with persistence it can track abuse such as concurrent use of product across different geos.
Automatic Expiration
Subscription basis products limited to 30 days
CASB - Cloud Access Security Broker
Monitors all activities from on-prem to cloud traffic. Ensures policies such as encryption at rest on cloud is enforced. Or detecting Shadow IT.. Logs all activities. Includes authentication and authorization controls to cloud resources.
Pseudonymization
Process of using pseudonyms to represent other data. Its an alias. Useful for GDPR
Tokenization
Use of a token, random string of characters, to replace other data. Typically for Credit Card transactions.
Anonymization
Used when personal data is not needed. Process of removing all relevant data so that it is theoretically impossible to identify original subject or person.
Randomized masking - swaps data in individual columns so records no longer represent actual data.
Can not be reversed
Data Owners
Person who has ultimate org responsibility for data, CEO, Department Head.
Data Classification
Security Controls
Rules for appropriate use
Establish security requirements for system owners
Access and priviledges and access rights
Identification and assessment of common security controls where info resides
Asset Owner
Individual who owns the asset or system that process sensitive data.
Develops and maintains security plan
Training personnel
Assist in identification, implementation, and assessment of common security controls.
Business and Mission Owners
Responsible for ensuring systems provide value to the organization
Use of governance methods like COBIT to help business owners and mission owners balance security control requirements with business and mission needs.
Data Processors vs Data Controllers
Data processor per GDPR is natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller
Data Controller - Controls / collects the processing of data
Data Custodians
Data owners often delegate day to day tasks to data custodians. Custodians protect integrity and security of data. Store, protected, backed up, audited/logs. Typically IT.
Administrators
Many orgs views any individual with elevated privileges to be administrators
Use of Security Baselines
Use of Imaging to establish systems baselines and then use of auditing processes to ensure no changes are made
NIST SP800-53 identifies baseline security controls
Tailoring and Scoping of Security Baselines
Tailoring modifies list of security controls baselines to align with organization mission.
Scoping is part of the tailoring process that reviews the baseline list of controls and selecting only those that apply to the IT systems trying to protect.
Four Fundamental Goals of Cryptography
Confidentiality, Integrity, Authentication, and Non Repudiation
Data at Rest, in Motion and in Use
Types of Cryptosystems that enforce confidentiality
Symmetric and Asymmetric
Digital Signatures
Ensures data was not altered in transit. Created upon transmission of a message.
Non Repudiation
Provides assurance to the recipient of a message that it originated by the sender and not someone else masquerading. It also prevents sender from claiming they did not send.
Only achievable using Asymmetric or Public Key cryptosystems
Kerckhoff’s Principles
The thought of allowing Algorithms to be public and known. The secret is kept in the keys themselves. Allows for more scrutiny on the algorithms and flush out exposures sooner for change and improvements.
Plaintext
Message prior to being encrypted. “P”
Cypertext
Message after encryption. “C”
Keys
All cryptographic algorithms rely on Keys. These are nothing more than a number. Large#
Key Space
Range of values that are valid for use as a key for a specific algorithm.
Cryptography
The art of creating and implementing secret codes and ciphers
Cryptanalysis
Study of methods to defeat codes and ciphers
Cryptology
combined Cryptography and Cryptoanalysis
AND Operation
Checks whether both values are true
OR Operation
Check whether at least one of the values is true
NOT Operation
Reverses the value of the input
XOR Exclusive OR
Returns true value only when one of the values is True
Modulo Function
The remainder value left after a division operation
One Way Functions
Mathematical operation that easily produces output values for each possible combination of inputs but makes it it impossible to retrieve the input values.
Nonce
Method used to add randomness to encryption process. A nonce is a random number that acts as a placeholder for mathematical functions.
