M2 S3 ISC CPA

COSO Enterprise Risk Management (ERM)

Framework that can be used as a reference for organizations to assess risks and to develop strategies around risk and business performance

Operational Objectives

Business objective based on performance measures and safeguards that can help increase the likelihood that an organization’s IT assets are protected against cybersecurity threats and fraud

• Focus on the effectiveness and efficiency of business operations

Reporting Objectives

Business objective that are related to increasing the likelihood that cybersecurity controls are in place so that they do not affect internal and external financial and non-financial reporting

• Objectives have a focus on transparency, reliability, timeliness, and trustworthiness as determined by standard setting bodies, regulators, and an organization’s own policies

Compliance Objectives

Business Objective that’s based on adherence to governmental laws and compliance regulations

• Compliance with industry standards such as those issued by NIST, HIPAA, and GDPR

Security Policies

The foundation of an organization's security framework that serves as a comprehensive guide that outlines the extent to which security measures are applied to various company resources

• Provides clear terms, roles and responsibilities, and acceptable levels of risk

• Evidence of due care by senior management against intrusions, attacks, and natural disasters

• Serves as an overview of an organization's security needs and strategic plan for what should be implemented

Acceptable Use Policy (AUP)

Control document that is created by an organization to regulate and protect technology resources by assigning varying levels of responsibilities to job roles, listing acceptable behaviors by employees and vendors, and specifying consequences of those who violate

• Users are asked to sign and agree to the terms prior to being granted access to systems, applications, and devices issued by the organization

• Covers:

  1. Definition, scope, purpose of policy

  2. Acceptable use of personal devices for business activities

  3. Acceptable mobile devices approved for use

  4. Device maintenance

  5. Confidentiality

  6. Monitoring and enforcement of actions on company devices

  7. Restricted activities and software downloads on company devices

  8. Software that must be installed for security purposes

  9. Security requirements

  10. Terms about termination if policy is violated

Security Standards

Organizational requirements that are mandatory by law or adopted by companies as guidelines for best practices; Organizations use as a benchmark to accomplish the goals defined by the security policies

• Next level of security rules beneath policies that serve as a course of action to achieve security policies

• May define a minimum level of performance and may provide recommendations on how to implement policies

Standards Operating Procedures (SOP)

The lowest level of documentation that provide detailed instructions on how to perform specific security tasks or controls; detailed documents that specifically outline how to perform business processes

• Involve a combination of systems, software, and physical actions so that the goals of the security policy and standards are achieved

Access Point (AP)

A wireless connection point for users to directly connect to a wired network using wireless-enabled devices

Bridge

Connects separate networks that use the same protocol, even if those networks have different topologies or transmission speeds

• Operate at the data link layer of a network

Hub

Connection points that link multiple systems and devices using the same protocol within a single network

• Receive data packets and forward them to all other devices

Proxies

Form of gateway that does not translate protocols but rather acts as a mediator that performs functions on behalf of another network using the same protocol instead of

just connecting the networks

Network Segmentation (Isolation)

Process of controlling network traffic so that it's either inaccessible or separated from outside communications or other segments within an organization's own network

• Improves overall network security

Service Set Identifier (SSID)

The name assigned to a wireless network is known as an SSID and is broadcast by a wireless access point within a certain range so that wireless-enabled devices can connect

Wi-Fi Protected Access (WPA)

Security protocol that encrypts traffic between a wireless access point, such as a switch, and a mobile device

• It does not encrypt traffic that travels through a wired connection once it is out of the wireless access point

Endpoint Sercurity

Every device, also called hosts, connected to a network should have some form of local security that is separate from any other security measure in place on the network or communications channel, such as antivirus software

Hardening

A multi-pronged comprehensive security approach that reduces risk by minimizing the number of access points where companies can be attacked

• Gives attackers fewer opportunities to access and infiltrate an IT system

1. Database Hardening: Different privilege levels so there’s a clear delineation between administrative users and users that have tiered need-to-know access

2. Endpoint Hardening: Remove administrative rights for users on local devices so endpoint users can only perform authorized functions.

   • Restrict users from downloading certain files from the internet or email

3. Network Hardening: Revise rules for firewall so it’s configured to remove unused ports and block unnecessary protocols

4. Server Hardening: Physically segregate servers in a secure facility, separating backup servers geographically

   • Develop test procedures

Tunneling

Encryption protocol that’s a process where data packets in one protocol are encapsulated in packets within a different protocol, creating a tunnel of protection

• Used in VPN

Internet Protocol Security (IPsec)

Encryption protocol that uses cryptography to encrypt communications, provide access control, and authenticate using IP protocols

• Used to only encrypt certain pieces of data, the payload, rather than an entire IP packet

• Gives VPN users secure remote access to company applications, data, and systems.

Media Access Control (MAC) Filtering

Form of filtering where an access point blocks access to unauthorized devices using a list of approved MAC addresses

• Mac address = Unique identifier found on devices in a network that is used as an address for communicating with other devices on network

Zero Trust

Assumes that a company's network is always at risk, even after a user has been authenticated, and it shifts a company's cybersecurity focus away from one-time authentication to continuous authentication at every point of a user's interaction with a network

• Zero Trust Network Architecture (ZTNA) model helps organizations implement continuous authentication principles through a zero-trust architecture (ZTA)

  • ZTA prevents data breaches and limit internal lateral movement by implementing a set of system design principles and a coordinated cybersecurity and system management strategy based on an acknowledgment that threats exist both inside and outside traditional network boundaries

  • Eliminates implicit trust and requires continuous verification by focusing on users, assets, and resources in real time to determine access and other system responses

Tenets:

1. All devices and data sources are considered resources

2. All communications must be secure regardless of a network's location

3. Access to company resources is granted on a per-session basis

4. Access is determined by using dynamic policies and other environmental or behavioral attributes

5. The company monitors and measures the integrity and security of all assets

6. All authorization and authentication mechanisms are dynamic and strictly enforced prior to granting access

7. Detailed information is collected about the current state of a company's assets, infrastructure, and communications to improve security.

Least Privilege

Cybersecurity Policy where users and systems are granted the minimum authorization and system resources needed to perform a function

• IT administrators should put safeguards in place so that privileges do not become excessive or allow privilege creep in which access to systems gradually increases over time as a person’s job role evolves

• Focuses on minimizing the access to system resources

Need-to-Know Principle

Cybersecurity Policy that follows the idea that employees are only given what they must know (data) to perform their job.

• Idea that employees are only granted minimum authorization to perform their job

• Focuses on minimizing the data accessed

Whitelisting

Cybersecurity Policy process of identifying a list of applications that are authorized to run on an organization’s systems and only allowing those programs to execute

• Referred to as “Allowlisting”

Blacklisting

Cybersecurity policy process of identifying a list of applications not authorized on a network and preventing those from running

• Rules are enforced by automated software programs designed to prevent applications from executing unless they are on the whitelist

• Referred to as “denylisting”

Context-Aware Authentication

Authentication technology used to identify mobile device users by using contextual data points such as time, geographic location of the user, point of access (mobile app, desktop browser, call center, etc.), or IP address

DIgital Signatures

Authentication technology in the form of an electronic stamp that is encrypted and used to verify the authenticity, integrity, and non-repudiation (proof of identity) of a digital message, document, or piece of data

• Uses encryption where sender encrypts the message with a private key and the receiver decrypts the message with the sender's public key

Single Sign-On (SSO)

Authentication technology that allows users to authenticate one time for a single session using multiple resources or devices

• Do not have to re-authenticate

Multi-factor Authentication

Authentication technology that uses two or more factors to validate a user's identity

• Combines knowledge (password) with possession (security fob)

Biometrics

Authentication technology that uses human physical characteristics or impressions to verify identity

• Facial recognition, fingerprint or palm scans, hand dimensions, voice recognition, iris or retina scans, heart or pulse patterns, keystroke patterns, and handwriting or signature dynamics

Hashing

The process of converting passwords into illegible text using hash algorithms (secure hash algorithms (SHAs))

• Passwords are then stored in databases, and when a user enters a password, the hashing algorithm is computed using that word

• Computed hash value is compared to the hash value stored in the database. If the two match, access is granted

• One-way = not intended to be reversed

Salting

The process of adding random strings of characters to the password input prior to running it through the hashing algorithms

• Makes cracking passwords significantly harder.

Iteration Count

The number of times a process is being repeated; in context of hashing —> hashing algorithm could be applied multiple times to enhance security

Provisioning

The process in identity management when an organization creates a user's account and provisions it with privileges based on their job role

• Automated, protected process that’s critical in creating a valid identification that can be authenticated

Vulnerability Management

A proactive security practice aimed at preventing the exploitation of IT vulnerabilities through identifying, classifying, mitigating, and fixing known security weaknesses

• Integral part of computer and network security/ play important role in IT risk management

• Applying the NIST Cybersecurity Framework is one way to implement vulnerability management solutions using six functions:

1. Govern - Establish and monitor the organization's cybersecurity risk management strategy, expectations and policy

2. Identify - Identify resource vulnerabilities, data, assets, and employees; understand the business environment policies established regarding those resources to define how governance is executed

3. Protect - Create safeguards against vulnerabilities by establishing measures to manage identity and access controls, keep assets secure, and inform employees of threats

4. Detect - Define relevant activities that can identify vulnerabilities quickly; search for anomalies, perform continuous monitoring, verify that the results of protective measures are effective

5. Respond - Put activities in place that will react to discovered vulnerabilities; analysis of issue so appropriate response is delivered, execute mitigating activities to prevent vulnerability from affecting other parts of the organization, and communicate to the organization what the issue is as well as the response

6. Recover - Help organization transition from its current state in which the vulnerability exists to a state where the vulnerability is mitigated; implement a recovery plan, improvements, and deliver internal communications to the appropriate staff about the recovery

Common Vulnerabilities and Exposure (CVE) Dictionary

A database of security vulnerabilities that provides unique identifiers for different vulnerabilities and risk exposures; helps standardize the recognition and naming of vulnerabilities that were once identified by various companies using differing names or descriptions

• As new vulnerabilities are discovered, they are added to the dictionary by MITRE

Defense-In-Depth

Most common layered security solution that It focuses on a multi-layered security approach that does not rely on technology alone, but combines people, policies, technology, physical and logical access controls

• Used with redundancy and diversity, which help organizations counter attacks that target different weaknesses an organization might have

Layers:

1. Personnel ←- Expertise to understand how all layers interact

2. Policies ←- Govern how technology should be used

3. Technology ←- Technical Controls: security solutions (IDS/ IPS, antivirus software, firewall, endpoint security

4. Physical Access Controls ←- Security measures like cameras, gates, locks, fences, badge-controlled access,

5. Logical Access Controls ←- Rule-based controls carried out by software/ hardware designed to prevent unauthorized access

Process Layering

Adds redundancy by breaking up an operation into smaller chunks that can be managed by different people, performed by a machine or computer, or completely isolated from other parts of the process

• Protects critical pieces of an operation or sensitive information so that certain components are more protected than less important pieces of the process

Process Isolation

Way to administer redundancy by using a machine/ computer that involves segmenting processes using logical controls to isolate different processes in a system to prevent them from influencing one another

Abstraction

Way to administer redundancy by hiding the complexity of certain tasks so that only the relevant information to a specific person performing a function is presented

• Simplifies complex tasks and limits user access so they are only given access to the level of detail needed to perform job

• Removes underlying details so that only essential information is available to help the user manage a task more efficiently and securely

Concealment

Way to administer redundancy by hiding data through assigning users to a security level that must align with the same security level assigned to specific sets of data, sections of applications, or certain objects so that only those who need access get it

Hardware Segmentation

Way to administer redundancy by dividing a network into smaller units, each governed by its own security policies and controls

• Enforces separation physically with separate machines that’s applied to large organizations with a network that is distributed geographically

Preventive Controls

Cybersecurity control that’s designed to thwart malicious activity from ever occurring

• Prevent attackers from accessing devices, applications, and networks

1. Safeguarding Practices: Strong preventive software and hardware controls coupled with well-designed policies and procedures (requiring strong passwords,

using MFA, performing background checks, locking devices if unattended, and following strict guidelines)

2. Education and Training: Inform employees about cybersecurity risks and corporate tools in place to mitigate risks

3. Regular Security Updates: Broad and comprehensive security enhancements occur regularly in order for an organization's physical and logical security measures to be protected

4. Encryption: Encrypting data at rest and in transit

5. Firewalls: Monitors and filters traffic based on a set of predefined rules so only trusted parties and networks can connect or interact with an organization's network

6. Patches: Update or modification to an existing software program that is a preventive and corrective control intended to resolve newly discovered design flaws, operating errors, or gaps

7. Physical Barriers: Tangible barriers designed to deter and prevent unauthorized physical access to an organization's IT infrastructure

8. Device and Software Hardening: Tools that help reduce totality of vulnerable points

9. Intrusion Prevention Systems (IPS): Network security solution that’s intended to detect and stop a cyberattack before it reaches the targeted systems

Detective Controls

Cybersecurity control that are designed to detect a threat event while it is occurring and provide assistance during investigations and audits after the event has occurred

1. Network Intrusion Detection System (NIDS) ←- Security solution that monitors incoming traffic on all devices on a network

2. Antiviruse Software Minoring

3. Network Monitoring Tools

4. Log Analysis

5. Intrusion Detection System (IDS)

Corrective Controls

Cybsercurity control that

Access Controls

Security measures put in place to o allow access only to authorized employees

• Administered using the following authorization models:

  1. Discretionary Access Control (DAC)

  2. Mandatory access controls

  3. Role-based access controls

  4. Rule-based access controls

  5. Policy-based access controls (PBAC)

  6. Risk-based access controls

Discretionary Access Control (DAC)

A decentralized control that allows data owners, custodians, or creators to manage their own access to the data or object they own or created

• Owners can grant access to others based on their own judgement or delegate tasks to other custodians as the owner sees fit

Mandatory Access Controls

Non-discretionary controls that allow administrators to centrally manage and enforce rules consistently across an environment

• Access is based on a general set of rules that governs the entire system

• Less flexible in terms of customization

Role-based Access Controls

Administer access based on a user’s job role instead of individually assigning permissions

• Job roles are placed in categories that correspond with a specific level of access or privilege

Rule-based Access Controls

Manages access to areas, devices, or databases according to a predetermined set of rules or access permissions independent of the user’s role or position within the organization

• Administrator is tasked with setting the security permissions to allow access based on defined criteria

Steps:

1. Access rules are created by administrator

2. Rules are integrated through access control system

3. User presents their access credentials

4. Control mechanism checks credentials against access rules

5. User is granted/ denied access

Policy-Based Access Controls (PBAC)

Uses a combination of user roles and policies consisting of rules to maintain and evaluate user access dynamically

• Framework to evaluate a user's access based on what is known about that user

• More flexible because they allow for the analysis of theoretical privileges based on actual privilege

Risk-Based Access Controls

Controls are applied based on the risk level of the asset being accessed, the identity of the user, the intentions of accessing the asset, and the security risk thatvexists between the user and the system or asset being accessed

• High-risk systems are have stricter security measures in place

Access Control List (ACL)

A list of rules that outlines which users have permission to access certain resources, such as a file, folder, directory, or other IT resource; used to manage user access and permissions

• Administers account restrictions ←- Ability to edit a file, read-only, or execute program

  • Does not have ability to recognize where data packets originate

1. Filesystem ACL: Grant/ deny privileges in an operating system by restricting access to certain files, folders, and directories

2. Networking ACL: Regulate the type of network traffic that is allowed to flow across a network by configuring routers, switches, and other network devices with an array of lists to enforce

Stateful ACL: Track the status of network connections and distinguish between legitimate packets and illegitimate packets

Bring Your Own Device (BYOD) Policy

Policy that allows employees to use their personally owned devices for work-related activities and for connecting directly to a company’s network

• Address:

1. Monitoring and Enforcement of Actions on Personal Devices: Enforce appropriate level of monitoring to prevent intrusion from malicious actors and set standards for respecting employee privacy

2. Ownership of the Data on the Device: Assume all information pertaining to company records, clients, vendors, and contacts are property of the organization, not the employee

3. Personal Liability and Indemnification: Stipulates when an employee is personally liable versus when company is liable; cover indemnification, defining who is responsible for compensating

4. Restricted Activities and Application Downloads on Personal Devices: Policies may be written so that certain applications are disallowed to prevent data breaches, data leakage, or access to a company's network.

Layered Security

Way to administer redundancy where the purpose is to protect an organization by using a diversified set of security tactics so that a single cyberattack or security vulnerability does not compromise an entire system; this is accomplished by implementing redundancy, diversification practices, or a defense-in-depth approach that provides multiple layers of protection

• Combine physical access controls, logical and technical controls, and administrative controls to provide control redundancy

Intrusion Prevention System (IPS)

A network security solution (preventive) that is intended to detect and stop a cyberattack before it reaches the targeted systems. It does this by receiving a direct feed of traffic so that all data coming into a network pass through the IPS, similar to a firewall.

Intrusion Detection System (IDS)

Security solution (detective) that scans the environment to monitor and analyze network or system events for the purpose of finding, and providing real-time or near real-time warning of, attempts to access system resources in an unauthorized manner

• Detects an attack after it has started, but it is unable to prevent it

• Provides continuous monitoring of the health of the client's environment and an early opportunity to prevent security breaches from worsening

• Service auditor inspect to determine that continuous monitoring of the client's network was in place and that early prevention of potential security breaches was also in place