Lesson 1 Flashcards
What is the CIA Triad?
Confidentiality
Integrity
Availability
Having all three for data information means you have good security. Missing any one of them is a problem for security
What is Confidentiality?
Confidentiality - Information has not been disclosed to unauthorized people.
Digital Confidentiality: Public/Private Keys / Encryption Algorithms
When you hear/see “encryption” this is about confidentiality
What is Integrity?
Integrity - Information has not been modified or altered without proper authorization.
Only the people who are authorized to to change information able to do so
Think “hashes” when the topic of integrity comes up.
What is Availability?
Availability - Information is able to be stored, accessed, or protected at all times.
Need to be able to store, access and protect information at all times.
What are the three A’s of Security? (AAA)
Authentication
Authorization
Accounting
What is Authentication?
Authentication - When a person’s identity is established with proof and confirmed by a system.
Real world: Driver’s license proves you are you.
What are the Five types of Authentication?
Something you know (e.g. password)
Something you are (e.g. fingerprint, facial recognition, etc.)
Something you have (e.g. like a token, a driver’s license, a credit card, etc)
Something you do (e.g. the way you speak, the way you sign your name)
Somewhere you are (e.g. based on your GPS location)
What is Authorization?
Authorization - Occurs when a user is given access to a certain piece of data or certain areas of a building.
What is Accounting?
Accounting - Tracking of data, computer usage, and network resources.
Think: log files
What is Non-Repudiation?
Non-Repudiation - When you have proof that someone has taken an action.
What are 4 main categories of security threats?
(1) Malware - Short for malicious software
(2) Unauthorized Access - Access to computer resources and data without the consent of the owner.
(3) System Failure - when a computer crashes or an application fails
(4) Social Engineering - Manipulating a user into revealing confidential information or performing other detrimental actions. (e.g. phishing, posing as a delivery man)
What are 3 Categories for Mitigating Threats
(1) Physical Controls
(2) Technical Controls
(3) Administrative (Managerial) Controls
What are Physical Controls
Physical Controls - alarm systems, locks, surveillance cameras, identification cards, and security guards (real world physical stuff)
What are Technical Controls?
Technical Controls - Smart cards, encryption, access control lists (ACLs), intrusion detection systems, and network authentication
What are Administrative Controls?
Administrative Controls - Policies, Security Awareness Training, contingency planning, disaster recovery plans
Two categories:
(1) Procedural Controls - Company decides to do on its own
(2) Regulatory Controls - Controls required by Law
