Cybersecurity 3 Chapter 1

• Assets

• Vulnerability

• Threats

• Exploit

• Attack

• Control

Enumerate 6 Elements of Cybersecurity (Endpoint Model)

Risk

Threat x Vulnerabilities x Consequences

Risk Management

Management of risks involves assigning weight for different contexts.

• Identification

• Assessment

• Analysis

• Response

Enumerate the 4 Importance of Risk Management (Cycle)

ERM

The comprehensive process of evaluating, measuring, and mitigating risks in an organization to achieve pre-defined business objectives.

Risk Exposure

The property that dictates how susceptible an organization is to loss

• Qualitative

• Semi-quantitative

• Quantitative

Enumerate 3 Risk Analysis Methods

Qualitative

Uses words to measure the likelihood and impact or risk

Semi-quantitative

Some issues defy numbers and cannot be quantified

Quantitative

Uses numbers to calculate the probable loss for every risk

• Legal

• Financial

• Physical Assets

• Intellectual Property

• Infrastructure

• Operations

• Reputation

• Health

Enumerate 9 Risks Facing in Enterprise

ESA Framework

Framework used to define baseline, goals, and methods used to secure the business

Special Publication (SP) 800-14

Generally Accepted Principles and Practices for Securing Information and Technology Systems

COBIT Frameworks

Created by ISACA, Initially in 1996

ITIL

• Comprehensive set of IT management publications

• Originally developed by the UK Government’s Central Computer and Telecommunications Agency (CCTA) in the 1980s

ISO Model

• First international standard for information technology management, based on BS15000 standard developed by BSI

• Provided comprehensive guidance on information assurance principles and processes

SABSA Framework

Risk-based approach to implement security that upholds business objectives

TOGAF Framework

High-level strategies for securing various dimensions of an architecture

System-Specific Risk Analysis

Analyze how systems are used

• Public

• Private

• Restricted

• Confidential

Enumerate 4 Classes of Information

• Confidentiality

• Integrity

• Availability

Enumerate 3 Classification of Information Types into CIA Levels

Technical

Hardware or software that prevents and mitigates threats to computers

Physical

Measures that restrict, detect, and monitor access to physical areas or assets

Administrative

Monitor organization’s adherence to security policies

CVE

A public directory of vulnerabilities using CVSS

Avoid

Eliminate risk by eliminating the source

Transfer

Move responsibility to third party

Mitigate

Reduce risk through controls and countermeasures

Accept

Determine that risk is within the organization’s appetite and do nothing further

Identify Exemptions

Legacy systems may be exempt from specific risk processes. Newer systems may change this, bringing on new risks, so you need to account for these exemptions

Use deterrence

The process of influencing threat’s decision to exploit or not exploit a risk. You can convince a threat that it is not worth the effort to attack a system.

Identify Inherent Risk

Risk that an event will pose if no mitigating controls are put in place. Helps you determine which controls to put in place.

Identify residual risk

Risk that remains after controls are put in place. Helps you determine the effectiveness of controls

IT Governance

Stakeholders ensure that IT resources align to objectives and add value

• Evaluate

• Direct

• Monitor

Enumerate 3 IT Governance (Cycle)

Evaluation Assessment

Identifying the state or products and services to spot problem areas and suggest redemiation

Auditing

Comparing state and services to an established baseline to identify violations that require remediation

Maturity Model Implementation

Reviewing organizations against expected goals and ascertaining level of risk based on this. Can help guide risk management strategies

Certification

Considering a product or service to have met all requirements after extensive tests. Assure stakeholders that a product or service is of sufficient quality, reducing risks.

• Encrypted Database

• Intrusion Detection System

• Vulnerability Assessment

• Network Segmentation

• Trained Personnel

Enumerate 5 Defense in Depth

• Policy

• Standards

• Guidelines

• Procedures

Enumerate 4 From Policy to Procedures

• Separation of Duties

• Job Rotation

• Mandatory Vacation

• Least Privilege

• Incident Response

• Forensics

• Employment and Termination

• Continuous Monitoring

• Training and Awareness

• Auditing

Enumerate 10 Best Practices to Incorporate Security Policies and Procedures

Acceptable Use Policy

Defines rules and restrictions for behavior

Account Management Policy

Define Admin responsibilities for identity security

Password Policy

Define rules for generation and maintenance of credentials

Data Ownership Policy

Defined how data is assigned to a certain personnel

Data Classification Policy

Outline how data sensitivity is categorized

Data Retention Policy

Defines how data is stored/purged

Patching

Fixes new vulnerabilities that are discovered everyday

Compensating Control Development

Mitigate risk when primary control fails

Control Testing Procedures

Tests can also evaluate planned or existing controls

Remediation Planning

Steps to remove or suspend a system from production

Exception Management

Exceptions arise when standard remediation doesn’t work

Evidence Production

Support forensic investigation process after an incident