Lesson 2: Summarize Fundamental Security Concepts

Information Security CIA Triad

Confidentiality, Integrity, Availability

Confidentiality

assurance that information is not disclosed to unauthorized parties.

Integrity

principle that data is complete and accurate (i.e. hasn't been modified) and that systems are trustworthy

Availability

information and systems are operating and accessible when needed

What are the 4 supporting principles of information security?

Authentication, Authorization, Accounting, Non-repudiation

Authentication

verifying identity

Authorization

approving access

Accounting

tracing actions to the sources

Non-repudiation

assuring the validity/origin of data (i.e. you can't say that you didn't send/receive something)

Privacy

an individual's right to control the use of their personal information (i.e. collection, usage, notification, accuracy, and sharing)

What are the 4 main OECD Privacy Principles?

Collection Limitation, Data Quality, Purpose Specification, Use Limitation

Zero Trust (ZT)

security framework requiring everything to be authenticated/authorized and continuously validated before granting/keeping access to resources

What are the 4 assumptions in a Zero Trust network?

No Implicit Zone Trust, No Ownership Assumptions, Insecure Connections, Consistent Security Policy

No Implicit Zone Trust

The private enterprise network is not considered implicitly safe - assume that an attacker is on the network

No Ownership Assumptions

Devices on the network may not be owned or configurable by the enterprise. Not all enterprise resources are on enterprise-owned infrastructure

Insecure Connections

Remote subjects should assume the local network is hostile. Assume that all traffic is being monitored and potentially modified.

Consistent Security Policy

Security posture shouldn't change depending on location. Assets should retain the same security posture when being moved to/from enterprise infrastructure.

What are the 4 core principles of Zero Trust?

Continuous Verification, Access Limitation, Limit the "Blast Radius", Automate

Access Limitation

access to resources is granted on a per-session basis (i.e. just because you had access today, doesn't mean you'll have access tomorrow)

Automate

ZT is impossible to implement manually. Automated process (i.e. context collection and response) are a must.

Networking Plane

abstract concept of where certain operations takes place

Control Plane

Used by infrastructure components to maintain/configure assets, access control, and communication security.

In ZT, access requests are made via the control plane.

Data Plane

Used for moving data between software components.

Policy Decision Point (PDP)

- functions as gatekeeper

- has 2 logical components: Policy Engine (PE) and Policy Administrator (PA)

Policy Engine (PE)

makes final decision for whether or not to grant access to the resource

Policy Administrator (PA)

generates any session-specific authentication and authentication token, or credential used to access an enterprise resource.

Policy Enforcement Point (PEP)

responsible for enabling, monitoring, and eventually terminating connections between a subject and an enterprise resource (in the data plane).

Physical Security

the protection of people, property, and physical assets from actions and events that could cause damage, loss, or unauthorized activity

Crime Prevention Through Environmental Design (CPTED)

the premise that proper design and effective use of the physical environment can lead to a reduction in crime

What 3 psychological and social responses does CPTED rely on?

1. People protect territory that they feel is theirs and respect the territory of others

2. Intruders don't want to be seen

3. Limiting access discourages intruders and marks them as intruders

Fail-Safe

in an emergency/fault situation all controls will default to open

Fail-Secure

in an emergency/fault situation all controls will default to closed

Site Security Controls

Lighting, Signs, Barriers, Guards

What are the 4 types of locks?

Pick Resistant: has an extra set of tumblers to protect against lock bumping

Electronic: use keypad or card system

Smart: connect via Bluetooth/Wi-Fi to a smartphone

Biometric: grant access based on a physiological trait (i.e. face, retinal, finger)

Passive infrared sensor

senses changes in heat signatures

Motion sensor

senses changes in movement

Photometric sensor

senses changes in light

Acoustical sensor

senses changes in noise

Contact sensor

senses penetration or break in an electrical circuit

Pressure sensor

senses change in surface weight

Microwave sensor

senses movement within an invisible field of energy (between the transmitter and receiver)

Ultrasonic sensor

proximity sensor that measures distance by emitting ultrasonic sound waves

Environmental Baselines

Temperature: ~64 to ~80 degrees

Humidity: 50-70 %

Power: continuous, clean power with consistent voltage

Fire: fire detection and suppression capabilities

Brownout

prolonged period of low volatage

Sag

moment of low voltage

Surge

prolonged period of high voltage

Spike

moment of high voltage

Blackout

prolonged period without power

Clean fire suppression agents (that won't damage electronic equipment)

FM-200, Novec 1230, inert gases

ESD

(Electrostatic discharge) Release of static electricity. ESD can damage or destroy electrical equipment

EMI and RFI

Electromagnetic Interference and Radio Frequency Interference

- copper cables are sensitive to EMI and RFI and should be shielded

Honey Traps

Deception technique that allows security defenders to understand attacker behavior patterns.

Includes honeypots, honeynets, honeyfiles and honeytokens.

Honeypot

Decoy system (e.g. webserver).

Can be high-interaction or low-interaction.

Honeynet

Multiple linked honeypots that simulate a network environment

Honeyfile

A decoy file designed to detect access and exfiltration attempts.

Honeytoken

A beacon embedded somewhere that can bait and track an attacker - comes in many different forms (e.g. document, database, image, cookies, executables).

Used to identify an attacker.

Spam Trap

Fake email address used to identify and block spammers

DNS Sinkhole

DNS server that responds with fake results.

Used to redirect malicious Internet traffic

Video Explanation: https://www.youtube.com/watch?v=X2Y_MvzIUko