Information Security Fundamentals.

Assets & Prioritization

• Assets = people, data, hardware, software (protect in that order)

• People (e.g., “Jim”) are irreplaceable; data is unique and often proprietary; tech (hardware, software) can be cloned, re-bought, or restored from backups and serve as tools for people and data.

Compliance

• Represents industry laws/regulations (e.g., HIPAA for healthcare, PCI-DSS for credit card processing, FISMA for U.S. federal agencies)

• Only the “bare minimum” to satisfy external mandates; $ext{compliance} \neq \text{security}$

• Compliance focuses on meeting specific standards and often involves checklist adherence, while security is a continuous, holistic process of protecting assets against evolving threats, typically exceeding mere compliance requirements.

Security Models

• CIA Triad:

  • Confidentiality (authorize access): Ensuring sensitive information is accessible only to authorized individuals. (e.g., encryption, access controls, data loss prevention).

  • Integrity (unaltered data): Maintaining the accuracy, completeness, and trustworthiness of data, preventing unauthorized modification or destruction. (e.g., hashing, digital signatures, version control).

  • Availability (ready when needed): Ensuring that authorized users have continuous and timely access to systems and data. (e.g., redundancy, backups, disaster recovery plans, high availability clusters).

• Parkerian Hexad = CIA +

  • Possession/Control (physical location of media): Relates to the physical custody and control over data and the devices storing it.

  • Authenticity (correct attribution/identity): Verifying the identity of users or the origin and validity of data/information.

  • Utility (usefulness of data): Ensuring that data is useful and in a usable format, providing value to the organization.

Attack Categories

• $4$ types: Interception | Interruption | Modification | Fabrication

  • Interception: Unauthorized access to data as it travels or while at rest. (e.g., eavesdropping, sniffing network traffic, unauthorized file access).

  • Violates confidentiality.

  • Interruption: An asset or data becomes unavailable or unusable, impacting operations. (e.g., Denial of Service (DoS) attacks, cutting network cables, power outages affecting servers).

  • Violates availability.

  • Modification: Unauthorized alteration of data or system configuration. (e.g., tampering with records, defacing a website, altering transaction details).

  • Violates integrity.

  • Fabrication: Creation of counterfeit data or activities to deceive systems or users. (e.g., injecting false data into a database, creating fake user accounts, replaying old authentication sessions).

  • Violates integrity.

Risk & Risk Management

• Risk = Threat + Vulnerability (+ Impact)

  • Risk: The likelihood of a threat exploiting a vulnerability and the resulting potential negative impact.

  • Threats: Potential sources of harm, which can be external events (e.g., malware, natural disasters, human error) or internal malicious actors.

  • Vulnerabilities: Weaknesses in systems, procedures, or controls that can be exploited by a threat (e.g., unpatched software, weak passwords, misconfigured firewalls).

  • Impact: The magnitude of harm or loss that could result from a security incident (e.g., financial loss, reputational damage, legal penalties, operational disruption).

• $6$-step process:

  1. Identify assets: Determine what needs protection, including people, data, hardware, and software systems.

  2. Identify threats: Catalog potential sources of harm that could exploit assets.

  3. Assess vulnerabilities: Discover weaknesses in current security measures and systems.

  4. Determine risk: Evaluate the likelihood of threats exploiting identified vulnerabilities and the potential impact.

  5. Select countermeasures: Choose and implement appropriate controls to mitigate or reduce identified risks.

  6. Ongoing review: Continuously monitor, assess, and update the risk management strategy to adapt to new threats and vulnerabilities.

Controls & Defense in Depth

• $3$ classes of controls:

  • Physical: Controls that guard the physical environment and access to assets. (e.g., locks, fences, security guards, biometric scanners, environmental controls like HVAC and fire suppression).

  • Technical / Logical: Software or hardware-based controls that enforce security policies. (e.g., firewalls, Intrusion Detection/Prevention Systems (IDS/IPS), Data Loss Prevention (DLP), encryption, multi-factor authentication, antivirus software, access control lists).

  • Administrative: Policy and procedure-based controls that define rules and guidelines for security. (e.g., security awareness training, Acceptable Use Policies (AUP), privacy rules, incident response plans, background checks for employees).

• Defense in depth: A multi-layered security strategy where multiple, overlapping control types (physical, technical, administrative) are implemented. This approach ensures that if one security layer fails or is bypassed, other layers are in place to detect the intrusion, contain the damage, and provide resilience, thereby reducing overall risk.

Incident Response Lifecycle

• $6$ phases:

  1. Preparation: Developing comprehensive plans, policies, and procedures; acquiring necessary tools; training personnel; and establishing communication channels.

  2. Detection & Analysis: Monitoring security events for anomalies, identifying potential incidents, investigating to confirm their nature, scope, and severity.

  3. Containment: Limiting the spread and impact of the incident to prevent further damage. This might involve isolating affected systems, disconnecting networks, or stopping malicious processes.

  4. Eradication: Removing the root cause of the incident and any lingering malicious components or artifacts from affected systems. (e.g., deleting malware, patching vulnerabilities, reconfiguring systems).

  5. Recovery: Restoring affected systems and data to a secure, operational state, ensuring full functionality and integrity. This may include restoring from backups, re-imaging systems, and validating services.

  6. Post-Incident: Lessons learned review, documenting the entire incident, analyzing contributing factors, identifying areas for improvement in security posture, and updating plans/policies to prevent reoccurrence.

Key Takeaways

• Security must enable, not hinder, business operations: Security measures should be designed to support business goals and processes, rather than creating unnecessary obstacles.

• Value-based protection: Prioritizing the protection of assets based on their criticality and value, ensuring that the most important assets (people, critical data) receive the highest level of protection.

• Multiple, overlapping safeguards $\approx$ higher resilience: Implementing a layered security approach (Defense in Depth) significantly increases an organization's ability to resist and recover from attacks.

• Continuous assessment & improvement are essential: Security is an ongoing process that requires constant monitoring, evaluation, and adaptation to evolving threats, vulnerabilities, and technological changes.