1.0

1.2 Fundamental Security not finsih yet

Confidentiality

•  Prevent disclosure of information to unauthorized individuals or systems

• Only authorized people or systems should be able to see information.

Confidentiality

- Certain information should only be known to certain people

• Prevent unauthorized information disclosure

- Why It Is Important:

• Personal Privacy: Protects personal data, health records, and financial details from prying eyes.

• Business Advantage: Safeguards proprietary data, product info, and business strategy to maintain a competitive edge.

• Regulatory Compliance: Mandates protection of PII, PHI, and financial data to avoid heavy fines and penalties.

Encryption

Confidentiality

• Encode messages so only certain people can read it

• It converts plaintext into protected data so intercepted information cannot easily be understood.

Access controls

Confidentiality

• Selectively restrict access to a resource

• limit which users can see particular resources.

Data masking

Confidentiality

• Obscuring specific data (e.g., showing only the last 4 digits of a credit card) to prevent accidental disclosure while retaining usability.

• Obscures portions of sensitive data to prevent unauthorized viewing.

Physical security measures

Confidentiality

• Using locked filing cabinets, biometric server room locks, and security cameras to protect physical and digital data

• Physical controls and training safeguard assets against physical breaches and human error. . 

Two-factor authentication

Confidentiality

• Additional confirmation before information is disclosed

Training & awareness

Confidentiality

• Conducting regular best-practice training to prevent human error, negligence, and social engineering.

Confidentiality

Example:

Marketing employees can access marketing presentations but are prevented from accessing accounting records.

Availability

-Why is it important ?

• Ensuring business continuity (preventing massive financial losses, such as $33,000 per minute in the telecom industry) 

• Maintaining customer trust. 

• Upholding the organization's reputation. 

-Information is accessible to authorized users

• Always at your fingertips

Redundancy

Availability

• Build services that will always be available

1. Server redundancy

2. Data redundancy

3. Network redundancy

4. Power redundancy.

Fault tolerance

Availability

• System will continue to run, even when a failure occurs

• Use multiple components so another component can continue if one fails.

Patching

Availability

• Stability

• Close security holes

• improves stability and closes vulnerabilities that could cause compromise or downtime.

Availability

Example

If one redundant server component fails, another takes over so users can continue accessing the service.

Non-repudiation

You can’t deny what you’ve said

• There’s no taking it back

Sign a contract

• Your signature adds non-repudiation

• You really did sign the contract

• Others can see your signature

Adds a different perspective for cryptography

• Proof of integrity

• Proof of origin, with high assurance of authenticity

Non-repudiation

• Provides strong evidence that information came from a particular sender.

• It combines proof of integrity with proof of origin.

• Digital signatures are used to provide non-repudiation.

Non-repudiation

Example

Alice digitally signs a message. Bob can verify both that the message has not changed and that Alice’s private key was used to sign it.

Proof of Integrity

Non-repudiation

-Verify data does not change

• The data remains accurate and consistent

-In cryptography, we use a hash

• Represent data as a short string of text

• A message digest, a fingerprint

-If the data changes, the hash changes

-Doesn’t necessarily associate data with an individual

• Only tells you if the data has changed

Proof of Integrity

Non-repudiation

• A hash acts like a fingerprint for data.

• Even a one-character modification can produce a very different hash.

• Hashing alone does not prove who sent the data.

Proof of Integrity

Example

Professor Messer’s Gutenberg example hashes an 8.1 MB encyclopedia file. Changing one character causes a different hash, revealing that the file changed.

Proof of Origin / Digital Signatures

Non-repudiation

Prove the message was not changed — Integrity

Prove the source of the message — Authentication

Make sure the signature isn’t fake — Non-repudiation

Sign with the private key

• The message doesn’t need to be encrypted

Verify with the public key

• Any change to the message will invalidate the signature

Notes 

• Sender hashes the plaintext and signs the hash with the sender’s private key.

• Receiver uses the sender’s public key to verify the signature.

• Receiver independently hashes the plaintext and compares the hashes.

• A successful comparison verifies integrity and provides proof of origin.

Example

Alice signs the hash of “You’re hired, Bob” with her private key. Bob verifies it with Alice’s public key and compares it with his own hash of the message.

AAA Framework

Identification — This is who you claim to be

• Usually your username

• is the identity claim

Authentication — Prove you are who you say you are

• Password and other authentication factors

• proves the claimed identity.

Authorization — Based on your identification and authentication, what access do you have?

• determines permitted resources.

Accounting — Resources used

• Login time, data sent and received, logout time

•  records activity. The AAA acronym itself is Authentication, Authorization, and Accounting

AAA Framework

Example

You enter a username, password and MFA; the system determines which files you can access and records your login and activity.

Authenticating People

• People commonly provide credentials and additional authentication factors.

Notes 

• A centralized AAA server can maintain authentication information.

• A VPN concentrator can forward credentials to the AAA server and act on the approval or denial.

Authenticating People

Example

A remote employee enters credentials into a VPN client; the concentrator asks the AAA server to validate them before allowing internal access.

Authenticating Systems / Certificate Authentication

-You have to manage many devices

• Often devices that you’ll never physically see

-A system can’t type a password

• And you may not want to store one

-Put a digitally signed certificate on the device

-An organization has a trusted Certificate Authority (CA)

-The organization creates a certificate for a device and digitally signs it with the organization’s CA

-The certificate can be included on a device as an authentication factor

Authenticating Systems / Certificate Authentication

Notes 

• Device certificates provide a way to authenticate machines.

• The CA signs the device certificate.

• Systems trusting the CA can validate that the certificate belongs to an approved organizational device.

Authenticating Systems / Certificate Authentication

Example

A corporate VPN validates a laptop’s device certificate and the trusted CA signature before recognizing the laptop as an approved device.

Authorization Models

The user or device has now authenticated — To what do they now have access?

Associating individual users to access rights does not scale

Put an authorization model in the middle

• Define by Roles, Organizations, Attributes, etc.

Using an authorization model adds an abstraction

• Reduce complexity

• Create a clear relationship between user and resource

Administration is streamlined

Authorization Models

Notes 

• Direct permissions for every user become difficult at scale.

• Groups or roles provide an abstraction layer.

• Permissions can be assigned to the group, and users receive them through group membership.

Authorization Models

Example

A Shipping and Receiving group is granted permission to create labels, track shipments, view reports, and access customer data. Employees receive those permissions by joining the group.

Gap Analysis

-Where you are compared with where you want to be

• The “gap” between the two

-This may require extensive research

-Work towards a known baseline

-NIST Special Publication 800-171 Revision 2

-ISO/IEC 27001 — Information security management systems

-Evaluate people and processes

-Compare existing systems and identify weaknesses

-Create a gap analysis report

• Formal description of the current state

• Recommendations for meeting the baseline

Gap Analysis

Notes 

• A baseline establishes the desired security state.

• The organization evaluates people, processes, policies, systems, and weaknesses against the baseline.

• Broad requirements are broken into smaller controls or tasks.

• Closing gaps can require time, money, equipment, security controls, and change control.

Gap Analysis

Example

Seven locations are compared with the same baseline. Red areas need significant work, yellow areas partially meet the baseline, and green areas are close to the goal.

Zero trust

-Many networks are relatively open on the inside

- is a holistic approach to network security

-Covers every device, every process, every person

-Everything must be verified

• Nothing is inherently trusted

• Multi-factor authentication, encryption, system permissions, additional firewalls, monitoring and analytics, etc.

Zero trust

Notes 

• Removes the assumption that something is trustworthy simply because it is inside the network.

• Users, devices, and processes must prove that they should have access.

Zero trust

Example

An employee on corporate Wi-Fi still must satisfy authentication and authorization requirements before accessing a protected server.

Control Plane

• Manages the actions of the data plane

• Define policies and rules

• Determines how packets should be forwarded

• Routing tables, session tables, NAT tables

Notes 

• Is the decision and management side.

• It configures firewall rules, routing, forwarding policies, and NAT.

Control Plane

Example

An employee on corporate Wi-Fi still must satisfy authentication and authorization requirements before accessing a protected server.

Adaptive Identity

• Consider the source and the requested resources

• Multiple risk indicators — relationship to the organization, physical location, type of connection, IP

Notes 

• Authentication can use contextual information in addition to credentials.

• Higher-risk situations can trigger stronger authentication.

Adaptive Identity

Example

A user normally connects from the U.S. but suddenly requests sensitive resources from an IP address in China, so the system requires additional authentication.

Threat Scope Reduction

• Decrease the number of possible entry points

Notes 

• Access can be restricted to approved paths, such as inside the building or through a corporate VPN.

Threat Scope Reduction

Example

Internal services are not exposed directly to the internet; employees must connect through the VPN.

Policy-driven Access Control

• Combine the adaptive identity with a predefined set of rules

Notes 

• User, device, connection, location, and requested-resource information can be evaluated against security policies.

Policy Engine

• Evaluates each access decision based on policy and other information sources

• Grant, deny, or revoke

Notes 

• The__evaluates requests against predefined policies and makes the access decision.

Policy Engine

Example

The Policy Engine evaluates a request and returns “grant” for an approved employee and managed device.

Policy Administrator

• Communicates with the Policy Enforcement Point

• Generates access tokens or credentials

• Tells the PEP to allow or disallow access

• Make the authentication stronger, if needed

Notes 

• It communicates the Policy Engine’s decision to the PEP and may create credentials or access tokens.

Policy Administrator

Example

The Policy Engine grants access; the Policy Administrator sends the decision and required credentials to the PEP.

Data Plane

• Process the frames, packets, and network data

• Processing, forwarding, trunking, encrypting, NAT

Notes 

• It performs the actual processing and movement of network traffic.

Data Plane

Example

A router physically forwarding a packet toward its destination is performing a data-plane operation.

Security Zones / Implicit Trust Zones

-Security is more than a one-to-one relationship

-Where are you coming from and where are you going?

• Trusted, untrusted; internal, external; VPNs; departments

-Using the zones may be enough by itself to deny access

• Some zones are implicitly trusted

Notes 

• Zones categorize traffic by source and destination.

• Different policies can be assigned between zones.

Security Zones / Implicit Trust Zones

Example

Untrusted-to-trusted traffic may be automatically denied, while approved trusted-to-internal traffic may be implicitly trusted by policy.

Subject / System

• Subjects and systems

• End users, applications, non-human entities

Notes 

• The entity requesting access may be a user, device, process, or application.

Subject / System

Example

Both an employee requesting a database record and an application requesting an API resource can be evaluated as subjects.

Policy Enforcement Point (PEP)

• The gatekeeper

• Allow, monitor, and terminate connections

• Can consist of multiple components working together

Notes 

• It sits between the subject/system and protected resource.

• It enforces the access decision but does not make the policy decision.

Policy Enforcement Point (PEP)

Example

If policy says “deny,” the PEP blocks the connection.

Barricades / Bollards

-Prevent access — There are limits to the prevention

-Channel people through a specific access point

• Allow people, prevent cars and trucks

-Concrete barriers / bollards, moats

Notes 

• __ physically control access and can guide people toward controlled entrances while preventing vehicles.

Barricades / Bollards

Example

Concrete bollards outside a data center let pedestrians approach but stop vehicles from driving directly toward the building.

Access Control Vestibule

• Opening one door causes others to lock

• Unlocking one door prevents others from being unlocked

• One at a time, controlled groups

- Managed control through an area

Notes 

• Interlocked doors create a controlled space between secure areas.

• Access may involve badges, biometrics, security personnel, and identification checks.

Access Control Vestibule

Example

You badge through the first door; the second remains locked until the first closes and your identity is verified.

Fencing

• Build a perimeter

• Transparent/opaque

• Robust — Difficult to cut

• Prevent climbing — Razor wire — Build it high

Notes 

• Fences establish a physical perimeter and should resist cutting, bending, knocking down, or climbing.

Fencing

Example

A data center uses a tall reinforced fence to prevent unauthorized access to the building.

Video Surveillance

• CCTV (Closed circuit television)

• Motion recognition can alarm and alert

• Object detection can identify a license plate or face

• Networked together and recorded over time

Notes 

• Modern cameras can provide motion detection, alerts, object detection, facial recognition, and license-plate recognition.

Video Surveillance

Example

A parking-lot camera detects after-hours movement and records the vehicle and license plate.

Security Guard

• Physical protection at the reception area of a facility

• Validates identification of existing employees

• Two-person integrity/control

Notes 

• Guards can verify employees and guests; multiple guards can provide checks and balances.

Security Guard

Example

Two guards must be present to access a highly restricted physical asset.

Access Badge

• Picture, name, other details

• Must be worn at all times

• Electronically logged

Notes 

• Badges provide visible identification and may integrate with electronic locks and central access logs.

Access Badge

Example

An employee badges into a server room; the system records the identity and entry time.