Chapter 1-Todays Cybersecurity Analyst

Cybersecurity Objectives - The CIA Triad

Four NIST threat categories

C- Confidentiality = keeping data private

    •    only authorized people should be able to access the information

Ex: Firewalls, ACL, Encryption

I - Integrity = Keeping data accurate and unchanged

    •    Data should not be changed by unauthorized people or by accident.

Ex: hashing, integrity monitoring

A - Availability = Systems are ready when needed.

    •    authorized users should be able to access systems and data anytime they need them.

Ex: Backups, Clustering, Fault Tolerance

Exam note: Security = protects the org’s data. Privacy = governs how the org collects, uses, and shares PII


Evaluating Security Risk

Vulnerability - a weakness in a device, system, application or process

Threat - an outside force that may exploit a vulnerability.

    •    Ex : Hacker

Risk - the combination of a threat AND a vulnerability. If either is zero, there is no risk.

NIST Risk Assessment Process

1    Prepare

Get ready for the assessment

 2    Conduct

Identify threats

Identify vulnerabilities

Determine likelihood

Determine impact

Determine Risk

3    Communicate Results

Share finding/results

 4    Maintain Assessments

Keep updating and reviewing it


Memory Trick

    •    Prepare → Check risks → Report → Repeat

Adversarial- Deliberate attacks- intentional attacks by people

Ex- insiders, competitor’s, nation states

Look out for: capability, intent, likelihood

Memory trick- Adversarial = attackers acting on purpose

Accidental- Routine mistakes- not attacks

Look out for: what could be affected, how big the damage

Memory trick- Accidental= honest mistake with real impact

Structural Threat- systems breaking over time

Ex- old hardware fail, software crash, too many users cause overload, resources running out

Controls- it maintenance, environmental controls, software updates

Memory trick- Structural= things wear out or break down naturally

Simple idea- there are ways to keep systems from breaking due to age, heat, overload, or bugs

Environmental- Natural/human disasters outside organizational control

Risk rating matrix- after you decide: likelihood and impact

You combine them in matrix to get the risk level

Likelihood + impact = risk


• Building a secure network

NAC= control who can join the network, checks device security

Main goals: only approved users/devices get access, devices must meet security rules

3 parts:

  • Supplicant= your device, send a request

  • Authenticator= switch or WiFi, gatekeeper

  • RADIUS server= checks identify and approves /denies access, brain of authentication, boss

NAC types:

  • Agent-based= software installed on device

  • Agentless= no software needed

  • In-band= traffic goes through security device, checks when traffic is moving

  • Out-of-band= authentication handled separately before full access, checking before you enter network