Domain 1 Reading

Cybersecurity is based on three objectives

  • Confidentiality: Private data stays private

    • Snooping, dumpster diving, eavesdropping, social engineering

  • Integrity: Information isn’t altered without permission

    • Unauthorized modification of information, impersonation, man-in-the-middle attacks, replay attacks

  • Availability: Information is available to authorized users when it is needed

    • Denial of service attacks, power outages, hardware failures, destruction of equipment, service outages

Non-repudiation is a security goal that prevents someone from falsely denying that something is true

Access Control Process

  • Identification: An individual makes a claim about their identity

  • Authentication: An individual proves their identity

    • Something you know: Password

    • Something you are: FaceID

    • Something you have: TribeCard

    • Multi-factor authentication: Requires multiple pieces which adds a lot of added security

  • Authorization: The access control system must be satisfied that an individual is allowed to access the system

  • Accounting: Keeping track of user activity through logging

  • Digital Access Control is how you do all these things online

Password Policies: length, complexity, expiration, history, resets

Privacy

Personally Identifiable Information: All information that can be tied back to an individual

Protected Health Information: Health care records regulated under the HIPAA

Reasonable expectation of privacy varies depending on the situation

Privacy Management Framework: Global framework for privacy management

  • Management: The entity defines, formally documents, communicates, and assigns accountability for its PI privacy policies and procedures

  • Agreement, notice, and communication: Requires that organizations inform individuals about their privacy practices and obtain agreement for information processing

  • Collection and creation: Governs how organizations come into possession of personal information

  • Use, retention, and disposal: The entity limits the use of PI to the purposes identified in formal agreements or notices and deletes it when those purposes are finished being fulfilled

  • Access: The entity provides PI access to individuals and allows updates and changes to data.

  • Disclosure to third parties: The entity discloses PI to third parties only for the purposes identified in privacy agreements, privacy notices, and the the consent of the data subject

  • Security for privacy: The entity protects PI against unauthorized access, removal, alteration, destruction, and disclosure

  • Data integrity and quality: The entity maintains accurate, complete, and relevant PI for the purposes identified in the notice and protects the representational integrity of the PI in its ongoing interactions with the data subjects

  • Monitoring and enforcement: The entity monitors compliance with its privacy policies and procedures and has procedures to address privacy complaints and disputes

Risk Types

Internal Risk: Risks that arise from within the organization

External Risk: Threats that arise from outside of the organization

Multiparty Risks: Risks shared across many organizations (ie through a SaaS provider that is compromised)

Legacy Systems Risk: Systems that have been around for a long time and lack current maintenance and therefore are often less secure

Intellectual Property: Information that if stolen, altered, or destroyed by attackers would risk significant damage to the business

Software license compliance

Language of Risk

  • Threats: External forces that jeopardize the security of information systems

  • Vulnerabilities: Weaknesses in security controls that a threat may exploit to undermine confidentiality, integrity, or availability of information systems

  • Risks: Occur when the environment contains a vulnerability and a threat that may exploit it

    • Risk Likelihood: Probability that a risk will actually occur

    • Risk Impact: Amount of damage that will occur if the risk occurs

Risk Assessment Techniques

  • Qualitative Techniques: Subjective judgements to assess risks as low, medium, or high

  • Quantitative techniques: Objective numeric ratings of risk from calculations (such as on financial data)

Risk Treatment

  • Avoid Risk: Change business practices so the risk no longer affects the business

  • Transfer Risk: Shift impact of a risk from one organization to another organization

  • Mitigate Risk: Actions designed to reduce the likelihood and/or impact of a risk

  • Accept Risk: Takes place as part of a thoughtful analysis that determines the cost of performing another risk management action

Risk Profile and Tolerance

  • Risk Profile: Combination of risks that affect an organization

  • Inherent Risk: Initial level of risk before controls are put in place

  • Residual Risk: Risk that remains after the inherent risk is reduced by controls

  • Control risk: New risk resulting from adding controls

  • Risk Tolerance: Deciding how much risk to accept

  • The goal is for control risk + residual risk < risk tolerance

Security Controls

Security control: Procedures and mechanisms that an organization puts in place to address security risks in some manner

Defense in depth principle: Applying multiple overlapping controls to achieve the same objective

Purpose Categories

  • Preventative Controls: Designed to stop a security issue from occurring in the first place

  • Detective Controls: Identify potential security breaches that require further investigation

  • Recovery Controls: Remediate security issues that have already occurred

  • Technical Controls: Use of technology to achieve security objectives

  • Administrative Controls: Processes put in place to manage technology securely

  • Physical Controls: Controls that impact the physical world

Ethics

Codes of professional ethics require that information security professionals act honorably and responsibly

ISC2 Code of Ethics

  • Canon 1: Protect Society, the common good, necessary public trust and confidence, and the infrastructure

  • Canon 2: Act honorably, honestly, justly, responsibly, and legally

  • Canon 3: Provide diligent and competent service to principals

  • Canon 4: Advance and protect the profession

  • Reporting complaints must be through a formal process on the ISC2 website

Security Governance

Security Policies: Bedrock documents that provide the foundation for an organization’s information security program. Compliance mandatory

Security Standards: Prescribe specific details of security controls that the organization must follow. Compliance mandatory

Security Guidelines: Guidelines to provide advice to the rest of the organization, including best practices for information security. Compliance not mandatory

Security Procedures: Step-by-step instructions that employees must follow when performing a specific security task. Compliance mandatory

Laws and regulations require us to figure out what exactly applies to us