Introduction Flashcards
Define information security
Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction
PCI Dss
Payment Card Industry Data Security Standard
FISMA
Federal Information Security Management Act – defines security standards for many agencies in the US
CIA triad
Confidentiality, Integrity, Availability
Confidentiality
CIA leg
ability to protect data from those who are not authorized to view it
Integrity
CIA leg
prevent people from changing your data in an unauthorized or undesirable manner
Availability
CIA leg
ability to access our data when we need it
Parkerian hexad
Donn Parker
CIA- confidentiality, integrity, availability
Authenticity
Utility
Possession
Authenticity
Parkerian hexad leg
allows you to say whether you’ve attributed data in question to proper creator
Possession
Parkerian hexad leg
AKA control
physical disposition of the media on which the data is stored
Utility
Parkerian hexad
how useful the data is to you
Not binary
Confidentiality attack(s)
Interception
Integrity attacks
Interruption
Modification
Fabrication
Availability attacks
Interruption
Modification
Fabrication
Interception
Attack which allows unauthorized users to access your data, applications, or environment
Affects confidentiality
Interruption
Attack which makes your assets unusable or unavailable to you on a temporary or permanent basis
Affects availability and sometimes integrity
Modification
Attack that involves tampering with an asset
Primarily affects integrity but could also be availability
Fabrication
Attack that involves generating data, processes, communications within a system
Affects integrity and sometimes availability
Threat
Something that has the potential to cause harm
Vulnerability
Weaknesses, or holes, that threats can exploit to cause harm
Risk
The likelihood that something bad will happen
Needs to have both threat and requisite vulnerability
Impact
Takes into account value of the asset being threatened and uses it to calculate risk
Risk management process
Identify assets
Identify threats
Assess vulnerabilities
Assess risks
Mitigate risks
Identify assets
Part of risk management process – 1
Enumerate and evaluate each asset
Identify threats
Part of risk management process – 2
Use CIA or Parkerian hexad to examine threats
Assess vulnerabilities
Part of risk management process – 3
In context of potential threats
Assess risks
Part of risk management process – 4
Vulnerabilities must have a matching threat, and vice versa, to constitute a risk
Mitigate risks
Part of risk management process – 6
Put measures in place to account for each threat – called controls
Control
Measure put in place to mitigate a risk
Control categories
Physical controls
Logical controls
Administrative controls
Physical control
Protect the physical environment in which your systems sit or your data is stored
Logical control
AKA technical control
Protect the systems, networks, and environments that process, transmit, and store your data
Ex: passwords, encryption, firewalls
Administrative control
Dictate how users of the environment should behave
Ex: change password every 90 days
Important to have ability to enforce them
Incident response definition
When risk management efforts fail or you are blindsided by something new
Incident response process
Preparation
Detection and analysis
Containment
Eradication
Recovery
Post-incident activity, AKA post-mortem
Preparation
Part of incident response process – 1
All the activities you can perform ahead of time to better handle an incident
Detection and analysis
Part of incident response process – 2
Detect issue to see whether or not it’s an incident
Use tools like intrusion detection (ID), antivirus software, firewalls
Combo of tool and human judgment
Containment
Part of incident response process – 3
Take steps to ensure the situation causes no more damage or lessen ongoing harm
Eradication
Part of incident response process – 4
Attempt to remove the effects of the issue from the environment
Recovery
Part of incident response process – 4
Restore the state you were in prior to the incident
Post-incident activity, AKA post-mortem
Part of incident response process – 6
Determine what happened, why it happened, and what you can do to keep it from happening again
Defense in depth
Formulate a multilayered defense that will allow you to still mount a successful resistance should one or more of your defensive measures fail
Varies for each specific environment
Defense levels
External network
Network perimeter
Internal network
Host
Application
Data
