Domain 5: Protection of Information Assets

What is the basis for designing and developing logical access controls?

The security policy

Who is accountable for the appropriate maintenance of security controls over information assets?

Data and system owners

What is the first step in data classification?

Establishing ownership, as it would be difficult to conduct criticality analysis or develop an access matrix if an owner is not defined.

Who is responsible for reviewing users’ access rights?

The data owner

What is the first step when reviewing an IT security baseline?

To determine the adequacy and sufficiency of the baseline

What are the common privacy principles?

Organizations should:

• Specify the use of the personal information that is collected

• Obtain consent before transfer of personal information to another jurisdiction

• Personal information should be retained as long as necessary

• Have appropriate controls and safeguards for protecting information

• Have appropriate process for reporting compliance with privacy policy, standards, and laws.

• Appropriate governance mechanism over the third party service provider processing privacy data on behalf of the organization

• ‘comply with applicable data protection regulations

What is the purpose of physical controls?

To protect information system processing facilities thorugh physical mediums to prevent data theft and breach of data leak

What is the purpose of environmental controls?

Controls that are in pace to protect systems, buildings, and related supporting infrastructure against threats with their physical environment.

What are the types of power failure?

1. Blackout: Total loss of power

2. Brownout: Severely reduced voltage and can strain, or even permanently damage, electronic equipment

3. Sags: Rapid decrease in voltage level

4. Spikes and surges: Rapid increase in voltage level

What is the most effective control to protect against short term reduction in electrical power?

The use of power line conditioner.

This control is a device that compensates for the reduction of voltage by providing its own power to maintain equilibrium.

What is Electromagnetic interference (EMI)

Caused by electrical storms or faulty electrical equipment and can cause system corruption/damage

What is the use of a uninterruptible power supply (UPS)?

Device that helps support an organization from interruptions that can last up to 30 minutes.

What are the best practices for the maintenance of an alarm control panel?

1. Should always be accessiible to security personnel

2. Should be placed in weatherproof box

3. Should have electrical power from a dedicated and separate circuit

4. Should be placed in adherence to local regulations and requirements.

What are the best practices for the maintenance of water and smoke detectors?

1. The location for the detectors should be easy to identify and access

2. The water detectior should be placed under raied floors and near drain holes

   1. the smoke detector should be placed above and below the ceiling tiles

What are the different types of fire supression systems?

1. Water based systems

2. Dry pipe Sprinkling Systems

What is the difference between water based systems and dry pipe sprinkling systems?

• In water based system, the water is always present within the system piping whereas for dry pupe sprinkling system, the water is only going to appear if the electronic fire alarm activates the water pump to send water

• Water based systems is more reliable and effective then dry pipe

• The disadvantage of using water based system is that the facility is at risk of water damage if the pipe breaks, whereas dry pipe sprinkling systems do not have this risk

Which gases are safe for humans?

Argonite and FM-200

If CISA asks, FM-200 is safer then argonite

These gases are used to put out fires

Which gases are dangerous for humans?

Carbon Dioxide and Halon Systems

What is halon systems?

These systems remove oxygen from the air to stave a fire

What is single sign on (SSO) ?

A user can use one set of login credential to be able to access multiple applications.

What are the advantages of SSO?

• No need to have multiple passwords

• Reduces time taken by users to log in to multiple applications

• Improves administrators ability to manage user accounts

• Reduce admin overhead cost in resetting passwords due to lower number of IT Help desk calls about passwords

What are the disadvantages of SSO?

• Most important disadvantage: If SSO fails, it has the risk of being the single point of failure

  • On the exam, if the option of single point of failure and acts as single authentication point shows up, the better answer is single authentication point.

• Supporting of all major operating system environments is difficult

What is the most important control for SSO?

Implementation of strong password policy

What is kerberos?

Technology that allows users to authenticate into the system through time limited tickets issues by a trusted key distribution center

What are the 3 factors of authentication that can be used for granting access?

1. Something you know (Ex. Passwords, PIN)

2. Something you have (Key card)

3. Something you are (Biometrics)

How do we know the layers of authentication? What is considered single factor, two factor, three factor, etc.

If the factors to be able to authenticate are of the same type, then it would be single factor. A good example is requireing a password and PIN to be able to authenticate. These authentication factors are both something you know and would be single factor.

If for example the authentication requirements are password and then a eye scan, then that would be two factor since that is something you know (password) and something you are (eye scan)

What is the objective of an IS auditor reviewing logical access control?

To determine whether access is granted and controlled as per the approved authorizations

What is the major risk of shared user accounts?

Individual user accountability may not be established

How can compliance with a password policy best be ensured?

With automated password management tools

What is the most important consideration when reviewing system controls?

Alignment of security and performance requirements

What is the best way to erase data?

Best method: Physical Destruction

Alternative method: Demagnetization/Degaussing: Using magnetic patterns that makes the stored information unreadable

What is the objective of using a naming convention?

Naming convention is grouping a set of assets under one name.

The objective of naming convention is to improve the implementaion of efficient access rules and to simplify security administration.

A good example of this is that if a group of assets are classified as sensitive critical assets, then there should be a standard procedure for sensitive critical assets

What is the first step in the implementation of logical access controls

To prepare an inventory of IS resources

What are the following steps to implement logical access control?

1. Prepare an inventory of the IS resources

2. Classify the IS resources

3. Perform grouping/labeling of the IS resources

4. Create an access control list

What is the most important control to prevent unauthorized access to databases ?

Block access after a specified number of unsuccessful login attempts

What does a does a default deny access control policy do?

Allows approved traffic and rejects all other traffic

• This minimizes the attack surface and prevents unauthorized or unknown traffic from entering

What does a does a default Allow access control policy do?

Denis specific traffic and allows all other traffic.’

• This allows access unless explicitly blocked. It is less secure control when compared to default deny access

What is biometric verification?

Verification of an individual by evaluating one or more distinguishing biological features

What are the biometric measure rates?

1. False acceptance rate: Rate of acceptance of unauthorized individuals

2. False rejection rate: Rate of rejection of authorized individuals even through the person is authorized

3. Cross error rate (CER) or equal error rate (EER): The rate in which the false acceptance and rejection are equal. So, this means that the most effective biometric control is the one with the Cross error rate

Which biometric measure rate is the best perforamcne indicator?

In terms of rank:

1. Cross error rate

2. False acceptance rate

3. False rejection rate

Note that though if the question asks about the overall performance indicator the answer will be CER, but if the question just asks about performance indicator, then it would be false acceptance rate

What are the key biometric attacks?

1. Replay: Residual biometric characteristics that are left on the device is sued by an attacker to gain unauthorized access

2. Brute force: Sending the device numerous biometric samples to force a way in

3. Cryptographic: Targets the algorithm or encrypted data transmitted between biometric device and access control system

4. Mimic: The attacker attempts to fake the biometric characteristics

What biometric characteristic has the highest reliability and lowest false acceptance rate?

Retina Scan

What is the biometric life cycle comprised of?

1. Enrollment: system analyzes the biometric identify and creates a biometric template for the individual

2. transmission: the goal is to protect biometric data as it being transferred between systems

3. storage: So, the goal is to protect biometric data from unauthorized access and alteration.

4. Verification: the process here is to verify that you are who you say you are. This step would require two factor authentication, such as doing a finger scan along side with entering a PIN. This is doing a 1 on 1 comparison

5. Identification: The system is trying to determine who’s biometric data it belongs to so it can log and identify the user log in attempt. This is doing a 1 to many comparison

6. Termination process: happens when biometric access is no longer required and access is revoked

Note that biometric controls are more reliable than any other form of access controls

What is the OSI layer?

It is the open system interconnections and describes how information moves from one computer to another

There are 7 layers and each layer manages a task

What are the OSI layers?

1. Physical

2. Data link

3. Network

4. Transport

5. Session

6. Presentation

7. Application

How does information flow within the OSI?

When a person sends out information from their computer, the sender information is sent out starting at the application level and works its way down to the physical level.

The person receiving the information from the receiver will first receive the information on a physical device, and the information works its way up the OS Iayer up to the application layer

What is the function of the application layer of OSI?

It is the layer that is closest to the suer and provides network services that application use to communicate.

Tip to remember: Application = What network service am I using?

What is the function of the presentation layer of OSI?

It is the layer that makes sure data is in a format that the receiving system can understand.

Major functions include:

• Data formatting

• Data translating

• Encryption / decryption

Tip to remember: Presentation = How should the data look to the receiving user

What is the function of the session layer of OSI?

It is the layer that is responsible for the communication between two systems.

Tip to remember: First think about establishing a connection between two computers, then the connection has to be maintained so that the data / information can be fully transferred, and after it has been competed, the connection is severed.

What is the transport layer of the OSI?

It is the layer that is responsible for the end to end delivery of data between two systems, ensuring the C&A of the data being transferred

Think of Transport = TCP + UDP + Ports

TCP - Transmission Control Protocol: This is connection oriented and the goal is to make sure that the data gets to its destination reliably.

UDP - User datagram protocol: this is a connectionless process and has the goal of just sending over the information

What is the function of the Network layer in OSI

It is the layer that is responsible for how data travels from source to destination across multiple networks

Tip to remember: Network = IP + router + Routing

When we see the words ‘packet filtering firewall’, the answer is network layer

What is the function of the data link in OSI?

It is the layer that is responsible for organizing bits into frames, and ensures reliable transfer between two connected devices

Tip to remember: Data link = MAC address + Switch + Frame

If I see words '‘Protocol Analyzer / Sniffer, answer should be data link layer

What is the physical layer of OSI

Lowest layer of OSI and handles the physical transmission of raw bits

Tip to remember: Physical = Cable + Signal + Bits

At which OSI layer does the packet filtering firewall operate?

Network Layer

Purpose of the network layer is to insert the IP address into the packet header and route the packet to its destiantion

What are the types of firewall?

1. Packet Filtering Router

2. Statefull Inspection

3. Circut Level

4. Application level

What is Bastion Host?

A hardened/computer that is exposed to an untrusted network, such as the internet, while helping proceting the internal network.

Think of it like a reception stand, where the reception is exposed to all guests, but the guests are not allwoed to go to restricted areas.

In bastion host, only essential services and processes are enabled to remove reduce the attack risk

What is a proxy?

A proxy acts as a middle man and stands between internal and external network.

A proxy will not allow direct communication between 2 networks

Proxy that works at the session layer (lower layer) is the circuit level proxy and the proxy at the application layer (higher level) is the application level proxy.

What is the packet filtering filter for types of firewalls?

Simplest kind of firewall and it is an allow or deny action that is done as per IP address and port number of source and destination

In simple terms, the firewall decides whether to allow or block individual pieces of data by examining basic information such as the source and destination IP address and port number and comparing it to its rules to approve or deny the information to be sent or received.comparing.

works at the network layer of OSI

What is statefull inspection firewall?

Type of firewall that keeps track of the information that was sent out from the internal network and ensures the the incoming message is in response to the information that was sent out

It remembers the information about the state of a connection/session and determines whether incoming traffic belongs to an established connection.

Works at the network layer of OSI

What is application level firewall?

works on the basis of bastion host and proxy server and has seperate proxies for each application. This works at the application layer of OSI

Application level firewall is the MOST SECURED environment

What is circut level firewall

Works on the basis of bastion host and proxy server and has the same proxy for all services. Works at the session layer of OSI

What are the ways to implement a firewall?

1. Dual homed firewall

2. Screened host firewall

3. Screened Subnet firewall (DMZ)

What is screened host firewall?

It has one packet filtering router and one bastion host

Imagine that data flows from the internet into the packet filtering router, then to the bastion host, which will communicate to the internal network.

Data only flows in that direction and can not go both ways

What is dual homed firewall

• It has one packet filtering router and one bastion host with two network interface card (NIC)

• More restrictive form of screened host firewall as it has 2 NIC whereas screened host only has 1

Imagine that data flows from the internet into the packet filter router which will then go into the bastion host (This is unsecured network (NIC) as data can flow from the bastion host to the packet filtering router and data from the packet filtering router can flow to the bastion host). From there the data from the bastion host can flow into the internal network, and the data from internal netwrok can also be flowed into the bastion host, which can send it outside the internal network (Secured network)

What is screened subnet firewall (Demilitarized zone)

• Has 2 packet filtering router and one bastion host.

• This is the MOST SECURE way to implement a firewall

Unlike the dual homed firewall, data cannot be flowed both ways from the bastion host.

In this type of firewall implementation, the data flows into the first packet filtering router (External one), which then routes information into the bastion host, which then will route the information into the second packet filtering router (internal one), from which data will flow into the internal network

What is next generation firewalls?

Advanced type of firewall that provides enhanced features to protect networks from a wide range of cyber threats.

• They are different from traditional firewalls as they also do the filtering of normal firewalls but go further by inspecting the content of the traffic and can identify and block threats such as malware, viruses, etc.

What is unified threat management ?

A comprehensive security solution that combines muiltiple security features, such as virus and malware protection, into one device or service that protects the network from threats.

What is VPN?

VPN is used to allow remote users to get connected to the organization’s network through private means while still using the internet.

It establishes a virtual point to point connection through the use of dedicated circuits or protocols

VPN can reduce the risk assocaited with sensitive data traveling in an open public network

What is the objective of VPN

To enable remote users and branch offices to access applications and resources avaliable on the private network of an organization

What is the most prevalent risk of VPN?

The entry of malicious code into the network

• this happens because the firewall cannot adequately examine the encrypted VPN traffic. So if a remote computer is compromised, the user can send malicious code through the VPN network to enter the organization’s private network

What is the most secured and cost effective method for remote access?

The use of a VPN

What can be used to ensure the security in a VPN?

Data Encapsulation, which means to wrap the data inside another packet/wrapper to hide the data so that it can travel through the VPN tunnel

What is the difference between firewall and VPN?

Firewall filters traffic between networks whereas VPN secures remote access over the internet.

What are the components of LAN?

1. Repeater

2. Hub

3. Switch

4. Bridge

5. Router

Note that the components of LAN operate within the OSI model. The higher the layer the more intelligent the device will be

Which OSI layer does the repeater LAN component operate at?

Physical layer

Which OSI layer does the hub LAN component operate at?

Physical layer

Which OSI layer does the Switch LAN component operate at?

Data link

Which OSI layer does the Bridge LAN component operate at?

Data Link

Which OSI layer does the router LAN component operate at?

Network layer

What is a repeater in terms of LAN component?

A telecommunications device that receive a signal and retransmits it

Why is hub component considered dumb relative to switch?

Hub will transmit information to all devices, even though the message was intended for only one device to receive. This causes high bandwidth, traffic, and collusion

Switch does not have this problem and will transmit information to only the intended device and prevents collusion.

Furthermore, Hub cannot learn to store MAC address, where as switch can. Note that the MAC address is an identifier that is used to recognize a device on a local network

What is a router?

Router operates at the network layer and it is the more intelligent version of switch.

• Router operates and looks for IP addresses to direct the information to its correct destination. This is possible as a router is connected within a network segments

• Router makes it possible for LAN components in the data link and physical layer to transmit information to each other, as the router is the middleman to transfer the data.

• Furthermore, router can block broadcast information, block traffic of unknown addresses, and fiilter based on network or host information

What is bridge?

Operates at the data link layer

• operates similarly to switch where it examines the MAC address to make decisions to direct the information to its destination.

The difference between bridge and switch is that brdige contains only few ports for LAN connectivity whereas switch has many ports for LAN connectivity.

• Furthermore, Bridge has the capacity to store frames and act as a storage and forward device

What is gateway device?

Device that enables communicationn between different networks that use different protocols, archietecures, or data formays.

• It acts as a translator to ensure taht data sent form one system can be understood by another.

• Gateway device can operate at multiple OSI layers depending on the function

Note: Router is the most common gateway device, as router works on IP address which allows your device to connect to external networks

What are the network physical medias?

1. Twisted Pairs (Copper Circuits)

2. Fiber optics

3. Co-Axial

4. Radio Systems (Wireless)

What is twisted pairs (Copper Circuits)

It is when two insulated wires are twisted around each other, with current flowing through them in opposite directions. There are two types os pairs that can be used:

1. Unshielded Twisted Pair (UTP): the twisted wires are not protected and are exposed.

2. Shielded Twisted Pair (STP): The twisted wires are protected

UTP has more attenuation, more interference (EMI), and more cross talk relative to shielded Twisted pair

What is the better choice between unshielded twisted pair and shielded twisted pair

Shielded twisted pair

What is fiber optics?

It is the most secured mode of data transmission as fiber optic systems have a low transmission loss when compared to twisted pair circuits.

• Fiber optics are not effected by EMI and present a lower risk of security problems

• Fiber is the preferred choice when it comes to high volume and longer distance runs

• Has very low attenuation, not affected by intrerference, and not affected by cross talk

What are the advantages and disadvantages of Co-Axial cables?

Advantages:

Easy installation and ready available

Low attenuation, but not as low as fiber optics

Good resistance to EMI but not complete unlike fiber optics

Minimum cross talk but still has some effect whereas fiber optics are unaffected.

Disadvantages:

Expensive

Distance sensitive

Difficult to modify

Does not support many LANs

What is attenuation?

It is the weakening of signals during transmission.

• It exists in both wired and wireless transmissions

• The longer the length of wire impacts, the higher the severity of attenuation

What is EMI

EMI is a disturbance generated by an external source (Electrical storms or noisy electrical equipments)that affects an electrical circuit.

• The disturbance can cause performance to deter and can even stop it completely.

What is cross talk

It is the electromagnetic interference from one unshielded twisted pair to another twisted pair, normally running in parallel

What is the best practice to reduce transmission errors?

Separate conduit for electrical cables and data cables

What is a dedicated line ?

It is used exclusively by one organization and is not shared with others. this reduces the risk of data interception and provides better security and reliability compared to shared transmission media

Rank the network physical devices from most secure to least secure

1. Fiber optics

2. Co-Axial cables

3. Shielded Twisted Cables

4. Unshielded twisted cables

What is network attached storage?

Type of storage device that connects to a network, allowing multiple users and devices to store and retrieve data from a central location

what is content delivery network (CDN)?

system of servers distributed around the world that deliver internet content quickly and efficiently.

What is network time protocol?

system used to Synchronize the clocks of computers over a network, having a universal clock. It is important for things such as logging, scheduling, and maintenance

What is network segmentation?

Practice of dividing a larger network into smaller, separate sections or segments.

• Each segments works independently, but can still communicate with each other as needed.

• This helps improve security, performance, and management of network by isolating different parts of the network from one another.

Network segmentation works by creating virtual or physical boundaries within your network and be set up with methods:

• Virtual local area network: Creating seperate network segments locally

• Firewalls: Used to control and limit traffic between different segments.

• Subnets: divide a large network into smaller more manageable pieces with their own unique IP address range.