Module 2 Flashcards
Security Frameworks
Guidelines used for building plans to help mitigate risks and threats to data and privacy
Security Controls
Safeguards designed to reduce specific security risks
Authentication
Process of verifying who someone or something is
Biometrics
Unique physical characteristics that can be used to verify a persons identity
Authorization
The concept of granting access to specific resources within a system
Integrity
The data is correct, authentic, and reliable
Availibility
Data is accessible to those who are authorized to access it
Confidentiality
Only authorized users can access specific assets or data
NIST Cybersecurity Framework (CSF)
A voluntary framework that consists of standards, guidelines, and best practices to manage cybersecurity risk
NIST S.P. 800-53
A unified framework for protecting the security of information systems within the federal govenment
NIST CSF Core Functions
Identify
Protect
Detect
Respond
Recover
Identify
The management of cybersecurity risks and its effect on an organizations people and assets
Protect
The strategy used to protect an organization through the implementation of policies, procedures, training, and tools that help mitigate cybersecurity threats
Detect
Identifying potential security incidents and improving monitoring capabilities to increase the speed and efficiency of detections
Respond
Making sure that the proper procedures are used to contain, neutralize, and analyze security incidents, and implement improvements to the security process
Recover
The process of returning affected systems back to normal operation
OWASP
Open
Web
Applications
Security
Project
OWASP Security Principles
Minimize attack surface area
Principle of least privilege
Defense in depth
Separation of duties
Keep security simple
Fix security issues correctly
Security Audit
A review of an organization’s security controls, policies, and procedures against a set of expectations
Purposes of Internal Security Audits
Identify organizational risk
Assess controls
Correct compliance issues
Common Elements of Internal Audits
Establishing the scope and goals
Conducting a risk assessment
Completing a controls assessment
Assessing compliance
Communicating results
Audit Questions
What is the audit meant to achieve?
Which assets are most at risk?
Are current control sufficient to protect those assets?
What controls and compliance regulations need to be implemented?
Control Categories
Administrative controls
Technical controls
Physical controls
Stakeholder Communication
Summarizes scope and goals
Lists existing risks
Notes how quickly those risks need to be addressed
Identifies compliance regulations
Provides recommendations
Audit Checklist
Identify the scope of the audit
Complete a risk assessment
Conduct the audit
Create a mitigation plan
Communicate results to stakeholders
