Chapter 1 (the basics)

Question 1

What is information security?

Answer 1

Information security is defined as “protecting information and information systems
from unauthorized access, use, disclosure, disruption, modification, or destruction,”. In essence, it means we want to protect our data and
our systems from those who would seek to misuse it.

Question 2

What is the relation between security and productivity?

Answer 2

As we increase the level of security, we usually decrease the level of productivity.

Question 3

What are the three points in the CIA triad?

Answer 3

Confidentiality, Integrity, Availability

Question 4

Define confidentiality in terms of Info security

Answer 4

Confidentiality is a concept similar to, but not the same as, privacy. Confidentiality
is a necessary component of privacy and refers to our ability to protect our data
from those who are not authorized to view it. Confidentiality is a concept that may
be implemented at many levels of a process.

Question 5

Define Integrity in terms of Info Security

Answer 5

Integrity refers to the ability to prevent our data from being changed in an
unauthorized or undesirable manner. This could mean the unauthorized
change or deletion of our data or portions of our data, or it could mean an
authorized, but undesirable, change or deletion of our data. To maintain integrity,
we not only need to have the means to prevent unauthorized changes to
our data but also need the ability to reverse authorized changes that need to be
undone.

Question 6

Define Availability in terms of info security

Answer 6

Availability refers to the ability to
access our data when we need it. Loss of availability can refer to a wide variety
of breaks anywhere in the chain that allows us access to our data.

Question 7

What are the 6 points of the Parkerian Hexad?

Answer 7

Confidentiality, Integrity, Availability, Possession, Authenticity, Utility

Question 8

Which points of the CIA triangle are affected by Interception attacks? Modification? Fabrication?

Answer 8

Confidentiality is affected by Interception attacks, Integrity and Availability are affected by Modification Fabrication and Interruption attacks.

Question 9

Discuss the relation between threats, vulnerability and risk.

Answer 9

Ultimately, this is what a threat is—something
that has the potential to cause us harm. Threats tend to be specific to certain
environments, particularly in the world of information security. Vulnerabilities are weaknesses that can be used to harm us. In essence, they
are holes that can be exploited by threats in order to cause us harm. Risk is the likelihood that something bad will happen. In order for us to have
a risk in a particular environment, we need to have both a threat and a vulnerability
that the specific threat can exploit.

Question 10

What are the categories of Controls?

Answer 10

Physical controls are those controls that protect the physical environment in
which our systems sit, or where our data is stored.

Logical controls, sometimes called technical controls, are those that protect
the systems, networks, and environments that process, transmit, and store our
data. Logical controls can include items such as passwords, encryption, logical
access controls, firewalls, and intrusion detection systems.

Administrative controls are based on rules, laws, policies, procedures, guidelines,
and other items that are “paper” in nature. In essence, administrative controls set out the rules for how we expect the users of our environment to
behave.

Question 11

What is the concept of defense in depth?

Answer 11

A multilayered defense. From outside to inside:

External network-Internal Network-Host-Application-data