1.0 Security Concepts

Chapter 1: Security Concepts

1.1 Security Introduction

Key Terms

  • Security Operations Center (SOC): A centralized unit that deals with security issues on an organizational level.

  • Development and Operations (DevOps): Integration of software development and IT operations to improve collaboration.

  • DevSecOps: Incorporation of security in the DevOps process to ensure secure software development.

  • Computer Incident Response Team (CIRT): A team dedicated to responding to cybersecurity incidents. Related terms include CSIRT (Computer Security Incident Response Team) and CERT (Computer Emergency Response Team).

Key Definitions

  • Security Operations Center (SOC): The location where security professionals monitor and protect critical information assets in an organization.

  • DevOps: The practice integrating software development with IT operations.

Security Concepts Overview

  • Assets: Valuable components within the information system.

  • Threats: Potential events that can cause harm to assets.

  • Threat Agents: Individuals or entities that carry out threats.

Example of Threat Agent in Action

  • North Korea's Hack on Sony Motion Pictures: An instance highlighting the impact of a state-sponsored threat agent.

Vulnerabilities and Exploits

  • Vulnerability: Any weakness that can be exploited by a threat agent (e.g., disgruntled employees can pose a risk).

  • Exploit: A method of taking advantage of a vulnerability.

Class Discussion

  • Information Security: Understanding its definition and implications.

  • Challenges for Security Professionals: Identify common hurdles in maintaining security.

  • Proactive Security Approaches: Discuss strategies to enhance security measures.

  • Integrity vs Non-repudiation: Explain the differences and their significance in security.

  • CIA Triad: The three main goals of information security: Confidentiality, Integrity, and Availability.

  • Risk Management Components: Identify key elements of risk management.

  • Types of Threat Agents: Discussion on the classification of threat agents.

1.2 Security Controls

Key Terms for Controls

  • Security Control: A measure or procedure to mitigate vulnerabilities.

  • Managerial, Operational, Technical, Physical Controls: Different categories of security measures implemented to manage risks.

  • Preventive, Detective, Corrective, Directive, Deterrent, Compensating Controls: Different control types based on their function.

Key Definitions of Security Controls

  • Preventive Control: Acts to eliminate or reduce the likelihood of incidents.

  • Access Control Lists (ACLs): Defines permissions and access rights to resources.

  • Detective Control: Identifies or records incidents as they occur.

  • Corrective Control: Minimizes damage after an incident has occurred.

  • Directive Control: Enforces rules of behavior via policies.

  • Deterrent Control: Discourages intrusions or malicious actions.

  • Compensating Control: Alternative measures when primary controls are ineffective.

Roles in Information Security

  • Chief Information Officer (CIO): Oversees management of IT assets.

  • Chief Technology Officer (CTO): Focuses on leveraging new technologies.

  • Chief Security Officer (CSO): Responsible for information assurance and security strategy.

  • Information Systems Security Officer (ISSO): Implements security policies and frameworks.

Control Categories and Types

Managerial Controls

  • Policies and Procedures: Define overall security framework and disaster recovery plans.

Operational Controls

  • Daily Operations: Security checks and visitor management processes.

Technical Controls

  • Technical Measures: Include software applications, network security appliances like IPS/IDS.

Physical Controls

  • Hardware and Environmental Controls: Include physical barriers like locks, gates, security cameras, and guard services.

Corrective and Compensating Controls

  • Corrective: Fixes damage caused by incidents and implements mitigation strategies post-event.

  • Compensating: Measures like data backups that help maintain security in the event primary controls fail.

Deter Bad Actors

  • Effective Measures: Use of mantraps, security training, access policies, biometrics, and surveillance to deter unauthorized actions.

Summary of Security Controls

  • Purpose: To help create a secure and resilient network.

Class Discussion on Controls

  • Control Categories: Discuss the three main types of security controls.

  • Preventive Controls: Delve into the significance of these controls in security management.

  • Corrective vs Compensating Controls: Clarify the differences and situations where each is applicable.