Section 2: Fundamentals Of Security Flashcards
Definition
Informational Security
Protecting data and information from unauthorized access, modification, disruption, disclosure, and destruction
Definition
Information Systems Security
Protecting the systems (e.g. computers, servers, network devices) that hold and process critical data.
Definition
What is the CIA Triad?
- Confidentiality - Ensures information is accessible only to authorized personell
- Integrity - Ensures data remains accurate and unaltered
- Availability - Ensures information and resources are accessible when needed
Definition
Non-Repudiation
Guarantees that an action or event cannot be denied by the involved parties.
Definition
CIANA Pentagon
An extension of the CIA triad with the addition of non-repudiation and authentication
Definition
What are the Triple A’s of security?
- Authentication - verifying the identity of a user or system
- Authorization - Determining actions or resources an authenticated user can access
- Accounting - Tracking user activities and resource usage for audit or billing purposes
Knowledge
What are the Security Control Categories?
- Technical
- Managerial
- Operational
- Physical
Knowledge
What are the Security Control Types
- Preventative
- Deterrent
- Detective
- Corrective
- Compensating
- Directive
Definition
Zero Trust Model
Operates on the principle that no one should be trusted by default.
Knowledge
What planes we use to achieve zero trust?
- Control Plane - adaptive identity, threat scope reduction, policy driven access control, and secured zones
- Data Plane - subject/system, policy engine, policy administrator, and establishing policy enforcement points
Definition
Threat
Anything that could cause harm, loss, damage, or compromise our information technology systems.
Knowledge
Threats can come from the following:
- Natural disasters
- Cyber attacks
- Data integrity breaches
- Disclosure of confidential information
Definition
Vulnerability
Any weakness in the system design or implementation
Knowledge
Vulnerabilities can come from internal factors such as:
- Software bugs
- Misconfigured software
- Improperly protected network devices
- Missing security patches
- Lack of physical security
Definition
Risk Management
Finding different ways to minimize the likelihood of a negative outcome and acheive the desired outcome.
