Up to Date Professor messer notes

Control Categories

Technical: controls implemented using technical systems

Managerial: security that involve policies, planning and management

Operational: people instead of systems and day to day operations

Physical: limits physical access

Example of Technical Control

Firewalls, antivirus

Example of Managerial Control

security policies

Example of Operation controls

security guards. awareness program

example of physical controls

guard shack, fence, card readers

Control types

Preventative: prevents a security incident before it occurs

Deterrent: discourage an intrusion attempt

Detective: tell and log an intrusion attempt

Corrective: restore systems after an attack

Compensating: Alternatives when existing control does not work

Directive: directs people on what they should do to maintain security

CIA Triad

Confidentiality: Prevent disclosure of info to unauthorized users

Integrity: information cannot be modified without detection

Availability: information and system are available when needed

Example of Confidentiality

Encryption: encode messages to the person who can decrypt it

Access controls: limit access to certain information

Two-Factor Authentication: confirmation before information is given

Examples of Integrity

Hashing: converts data into a fixed-length value to verify its integrity

Digital Signatures: verifies the sender and confirms the data has not been changed

Certificates: verifies the user’s identity

Nonrepudiation: prevents someone from denying they performed an action

Examples of Availability

redundancy and fault tolerance

Nonrepudiation

Can’t deny what they did or say

Identification

who you claim to be, username

AAA

Authentication: prove who you are

Authorization: gain access based on your identification and authentication

Accounting: logs of what happened

CA

Certificate Authority: issues and manage all certificates

Abstraction

hides unnecessary details and show only essential information

Gap Analysis

Finding the difference of where you are and where you need to be

Zero Trust

Authenticate yourself every time you try to access a resource. never trust

Two types of Plane

Data Plane: handles and moves data based on control plane’s decisions

Control plane: makes decision and manage how things operate

Adaptive Identity

uses context and risk factors to decide how much authentication is required

policy-driven access control

uses policies to determine who can access resources and what actions they can perform

security zones

divide a network into sections to control access and limit impact of attacks

PEP

policy enforcement point: the point where access is actually allowed or denied

PDP/Policy Engine

policy decision point: decides whether access should be allowed or denied

PA

Policy Administrator: applies and send the PDP’s decision to the PEP