Module 1: Security and Risk Management

Question 1

What are the primary goals and objectives of a security infrastructure?

Answer 1

CIA Triad
Confidentiality: measures used to ensure protection of secrecy of data, objects, resources.
Integrity: protecting reliability and correctness of data
Availability: authorized subjects are granted timely and uninterrupted access to objects.

Question 2

What is the goal of Confidentiality protection?

Answer 2

The goal of Confidentiality is to prevent or minimize unauthorized access to data.

Question 3

Give examples of Countermeasures that can be used to protect Confidentiality agianst possible threats

Answer 3

• encryption
• strict access control
• rigorous authentication procedures
• data classification
• extensive personnel training
• network traffic padding

Question 4

List the concepts of Criticality

Answer 4

• Sensitivity: Quality of Information
• Discretion: Act of decision of operator
• Criticality: Level of mission critical
• Concealment: hiding to prevent disclosure
• Secrecy: Keeping something secret
• Privacy: Personally Identifiable information
• Seclusion: Storing out of the way
• Isolation: Keep separate from others

Question 5

What is the primary goal of Integrity in the CIA triad?

Answer 5

• Protecting reliabilty and correctness of data
• Allow for authorized changes while protecting against unintended and malicious changes.

Question 6

List and describe the main concepts related to Integrity?

Answer 6

• Accuracy: Is the Data correct and precise?
• Accountability: A person is responsible for the data, action, or result
• Truthfulness: True reflection of reality
• Validity: Being factual and logically sound
• Completeness: Having everything needed for the result
• Responsibility:Control of the data and that has been defined
• Comprehensiveness:Is all the data included and does it have all the necessary parts for the scope

Question 7

What is the primary goal of Availaibity in the CIA triad?

Answer 7

Authorized subjects are granted timely and uninterupted access (be available when needed)

Question 8

List and describe the main concepts of Availabilty

Answer 8

• Usability: How easy it is to use, learn, understood by a person
• Accessabilty: How easy or hard to manage
• Timeliness: Prompt, on time, or within a reasonable time for recovery

Question 9

Provide examples of Threats to Integrity

Answer 9

• Virus and logic bombs
• Errors in coding and applications
• Intentional replacement
• System backdoors

Question 10

Provide some examples of threats to Availabilty

Answer 10

• Device failure
• Software errors
• Environmental issues
• DoS attacks
• Communicatation interruptions

Question 11

Provide some examples of threats to Confidentiality

Answer 11

• Human error, oversite, ineptitude
• Intentional attacks (man in the middle)
• Misconfiguration

Question 12

List some Countermeasures to ensure confidentiality against possible threats.

Answer 12

• Encryption
• Network traffict padding
• strict access control
• rigorous authentication procedures
• data classification
• extensive user training

Question 13

List some countermeasures that ensure integrity against possible threats

Answer 13

• strict accdess control
• rigorous authenitcaion procedures
• intrusion detection systems (IDS)
• data encryption
• has verification
• input function checks
• extensive personnel training

Question 14

List some countermeasures that can ensure availability against possible threats

Answer 14

• desinging intermediary delivery systems properly
• using access controls effecgtively
• monitoring performance and network traffic
• using firewalls and routers to prevent DoS attacks
• implementing reduncancy for crytical systems
• Maintaining testing and backup systems

Question 15

What are the failures of security protections in the CIA Triad (DAD)

Answer 15

• Disclosure (Confidentiality)
• Alteration (Integrity)
• Distruction (Availabilty)

Question 16

What are the 5 concepts tied to AAA Services

Answer 16

AAA = Authenitcation, Authorization, Accounting
* Identification: Claiming to be an entity when attempting to access secure area
* Authentication: Proving you are the claimed entity
* Authorization: Defines the permissions (Allow/Grant/Deny)
* Auditing: Recording a log of events and activities related to the system
* Accounting: Revieiwing the files looking for compliance and violations

Question 17

What is the first step in the AAA security mechanism for all security environments?

Answer 17

Identification

Identification starts the process of authentication, authorization, and accountability. Without an identiy the system has no way to correlate an authentication factor with the subject.

Question 18

What is the second step in the AAA security mechanism for all security environments? What does it do?

Answer 18

Authentication

• Proving that you are are the claimed entity
• Requires person to provide additional information that matches identity
• Identification and authentication are commonly used together
• Without both you cannot access the system/device

Question 19

If a user has been verified as a authenticated user, then they still need to pass another gate in the AAA security mechanism. What is it? Why?

Answer 19

Authorization

• Defining the permissions (Allow/Grant/Deny)
• Once authenticated then authorization must ensue
• Ensures the request activity or access is granted
• Individual may have Identity / Authentication but no authorization

Question 20

What are the last two elements of the AAA Services? Why are they important?

Answer 20

Auditing
* Recording a log of events and activities related to the systems
* A program by which a subject’s actions are tracked/recorded
* Holding a person accountable for actions
* Additionally, it is process of looking for Unauthorized/abnormal activity

Accounting
* Reviewing the log files looking for compliance and violations
* Accountability must be maintained
* Linking an individual to online activities

Question 21

Many controls offer their protection through the use of Protection Mechanisms. What are they?

(4 protection mechanisms)

Answer 21

• Network / System Layering: Commonly called defense in depth: Example: Industrial Control Systems
• Abstraction: used when classifiying objects or assigning roles to subjecst. Simplifies security by enabling assignment of security controls to a group of people or objecs
• Obfuscation: (Hiding) of the Data: Preventing data/information from being discovered and/or accessible. Example: Labeling “Secret Sauce” to file 1234
• Encryption: Science of hiding the meaning or intent of a communication from unintended recipients. Shoud be applied to everey type of electronic communication or storage.

Question 22

Recite the ISC2 COde of ethics

Answer 22

• Protect Society, the common good, necessary public trust and confidence, and the infrastructure.
• Act honorably, honestly, justly, responsibility, and legally
• Provide diligent an competent service to principals
• Advance and protect the profession

Question 23

It is important to act ethically at all times. What are some examples of unethical behavior?

RFC 1087: Internet Activities Board (IAB)

Answer 23

• Do not seek to gain unauthorized access
• Do not disrupt the intended use of the internet
• Do not waste resources through actions
• Do not destroy integrity of the computer information
• Do not compromise the privacy of users

Question 24

What is Security Governance?

Answer 24

• Set pf rules, policies, processes that protect the organization.
• “Security governanceis the set of responsibilities and practices exercised by the board and executive management with thegoalof providing strategic direction, ensuring thatobjectivesare achieved, ascertaining that risks are managed appropriately and verifying that the enterprise’s resources are used responsibly.”

Question 25

LIst some of the frameworks that are available to help establish a solid security control program.

Answer 25

• ISO 27001/2: provides companies of any size and from all sectors of activity with guidance for establishing, implementing, maintaining and continually improving an information security management system.
• NIST: 800-53: comprehensive set of data controls for government offices.
• NIST CSF: Cybersecurity Framework: provides additional coverage of comprehensive data security.
• CIS Critical Security Controls: prescriptive, prioritized, and simplified set of best practices that you can use to strengthen your cybersecurity posture.
• AICPA Trust Services Criteria: Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (SOC for Cybersecurity)