Fundamentals of Security

Vocabulary flashcards for the Fundamentals of Security lecture.

Information Security

The act of protecting data and info from unauthorized access, unlawful modification and disruption, disclosure , corruption, and destruction (protect the data rather than the system)

Information system security

The act of protecting the system that hold and process the critical data

C.I.A.N.A

Consist of Confidentiality, Integrity, Availability, Non-Repudiation, Authentication, and Authorization

Confidentiality

Ensures that info is only accessible to those with the appropriate authorization

Integrity

Ensures data remains accurate and unaltered unless modification is required (tools like checkup)

availability

Ensures information and resources are accessible when needed

non-repudiation

Guaranteeing that a specific action or event has taken place and cannot be denied by the parties involved

Authentication

the process of verifying the identify of a user or system

Authorization

Determining actions or resources an authenticated user can access (permission based access to a specific part of the database)

Security Control categories

Consist of technical, managerial, operational, and physical

Security Control Types

Preventive, Deterrent, Detective, Corrective, Compensating and Directive

Zero Trust Model

The principle that no one, outsides or inside, of your organization is to be trusted by default. Can be achieved through understanding both the Control and Data Planes

Zero Trust Model: Control Plane

Encompass the whole network and is responsible for managing, enforcing, along with defining policies related to users/systems. Within this plane of control, there exist adaptive identity, threat scope reduction, policy-driven access control and secured zone.

Adaptive Identity

using real-time validation that takes into account the user’s behavior, devices, and locations.

Threat Scope Reduction

Limit user’s access to only what they need for their work tasks which also limit the surface of an attacker.