W11 L2 - Security, Continuity & End of Life

Question 1

What is the CIA triad

Answer 1

A tool or guide for securing information systems, networks and related technological assets.

Confidentiality

• “Rules that limit access to information”.
• “Protection of information from unauthorised access”.

Integrity - ensure ppl have the right access to change information

• “The assurance that the information is trustworthy and accurate”.
• “The condition where information is kept accurate and consistent unless authorised changes are made”.

Availability - information being accessible when you need it

• “A guarantee of reliable access to the information by authorised people”.
• “The situation where information is available when and where it is rightly needed”.

Question 2

Give examples of ensuring confidentiality

Answer 2

• Data encryption
• User IDs and passwords
• Two-factor authentication
  Awareness of social engineering methods
  Training for authorised people

Question 3

Give examples of ensuring Integrity

Answer 3

• File permissions and user access controls - give people permission to do certain activities
• Version control - integrity by time/date stamping
• Backups - expensive
• Checksums

Question 4

Give examples of ensuring Availability

Answer 4

• Hardware and software components - Architecture design
• Firewalls, proxy servers
• System upgrades up to date
• Minimal or no downtime (fast and adaptive disaster recovery)
  
  • Business contingency plan - having a plan B (carry on
    working when there is down time
• Early detection of a Denial of Service attack - where someone floods the system with number of requests causing system to crash/fail

Question 5

What are some other considerations for security

Answer 5

It is “better” to address security problems earlier rather than later.

Security is not free
- the risk could be risk of failure due to security
related issues.

Security vs. usability (and productivity)

Question 6

What is Business Continuity

Answer 6

The continuation of a business’s operations using their systems. It is about “keeping the system going”. In cases of natural disaster or breach.

Business continuity plan
- Managing information back-ups
- Backup sites (hot-sites or warm-sites)
- Implementing data (or even system) replication and 
  redundancy

Risk vs. cost (money, time and effort)

Question 7

What is End of Life (EOL)

Answer 7

• End of life, EOL, sunsetting, discontinuing, retirement, decommissioning, disposing, dispositioning, obsolescence of a system i.e. it is no longer needed.
• EOL - the end of the OPERATIONS phase
• When the SDLC finishes for a system.
• A term used to describe the “death” of a system.
• All parts of the system are “switched off” and disposed off.
  - If a system is “mission-critical”, another replacement
  system takes its place first.*

*Some legacy systems are kept alive for a long time for archival purposes.

Question 8

What is End of Support (EOS)

Answer 8

• A term used to describe the ending of all MAINTENANCE activities for a system.
• EOS happens before EOL.
• The SDLC continues (being operated) but no more mini-SDLCs will occur and system no longer receives any support from the support-provider.