1: Fundamental Security Concepts

What is the CIA triad?

Confidentiality, Integrity, and Availability.

What does Confidentiality mean in the CIA triad?

Information can only be read by people who have been explicitly authorized to access it.

What does Integrity mean in the CIA triad?

Data is stored and transferred as intended, and any modification is unauthorized unless explicitly authorized through proper channels.

What does Availability mean in the CIA triad?

Information is readily accessible to those authorized to view or modify it.

Which CIA principle is concerned with preventing unauthorized disclosure of information?

Confidentiality.

Which CIA principle is concerned with preventing unauthorized modification of information?

Integrity.

Which CIA principle is concerned with authorized users being able to access information when needed?

Availability.

What is non-repudiation?

Non-repudiation means that a person cannot deny doing something.

Why is non-repudiation important?

It provides evidence that an individual performed or approved an action and helps prevent them from credibly denying it.

What are the five functions of the cybersecurity framework developed by NIST?

Identify, Protect, Detect, Respond, and Recover.

What is a gap analysis?

A process that identifies how an organization's security systems differ from those required or recommended by a framework.

What is access control?

Access control governs how subjects (people) may interact with objects (resources).

In access control, what is a subject?

A person or entity that requests or performs an action on a resource.

In access control, what is an object?

A resource that a subject is attempting to access or interact with.

What does IAM stand for?

Identity and Access Management.

What are the four principles of IAM?

Identification, Authentication, Authorization, and Accounting.

What is Identification in IAM?

Creating an account or ID that uniquely represents the user, device, or process on the network.

What is Authentication in IAM?

Proving a user is who or what they say they are.

What is Authorization in IAM?

Determining what rights a user has on each resource and enforcing those rights.

What is Accounting in IAM?

Tracking and recording a user's or system's actions and resource usage.

What is the difference between identification and authentication?

Identification establishes or claims an identity; authentication proves that identity.

What is the difference between authentication and authorization?

Authentication proves who or what you are; authorization determines what you are allowed to access or do.

What is AAA in cybersecurity?

Authentication, Authorization, and Accounting.

What is a security control?

A security control is designed to give a system or data asset the properties of confidentiality, integrity, availability, and non-repudiation.

What are the four categories of Security Controls?

Managerial, Operational, Technical, and Physical.

What is a managerial security control?

A control based on management decisions, policies, procedures, risk management, or governance.

What is an operational security control?

A control implemented through people and operational processes.

What is a technical security control?

A control implemented primarily through technology, such as hardware or software.

What is a physical security control?

A control that uses physical measures to protect systems, facilities, or assets.

What are the three main Security Control Functional Types?

Preventative, Detective, and Corrective.

What is a preventative security control?

A control intended to prevent a security incident or unauthorized activity from occurring.

What is a detective security control?

A control intended to identify or discover security incidents or unauthorized activity.

What is a corrective security control?

A control intended to correct or restore a system after a security incident or unwanted event.

A firewall blocks unauthorized traffic before it reaches a server. What functional control type is this?

Preventative.

An IDS alerts administrators when suspicious network activity is detected. What functional control type is this?

Detective.

A backup is used to restore data after a ransomware incident. What functional control type is this?

Corrective.

A company creates a security policy requiring employees to use MFA. What security-control category is this?

Managerial.

Security guards monitor a facility and enforce physical security procedures. What security-control category is this?

Operational.

An access-control system automatically blocks an unauthorized login. What security-control category is this?

Technical.

A locked server-room door is what security-control category?

Physical.