Fundamental Concepts of Data Security

Security Management

  • Effective Security System

    • Requires planning, resources, and effort from all levels in an organization.
    • Management support is crucial for:
    • Listing assets/information to protect.
    • Providing resources (equipment, training).
    • Enforcing policy compliance and revisions.

  • Responsibilities

    • Achieve business goals.
    • Work with stakeholders.
    • Develop and implement policies, procedures, standards, and guidelines.
    • Perform risk analysis, assessments, and security audits.
    • Implement and monitor security programs to ensure compliance.

  • Management Approaches

    • Top-down
    • Initiated and supported by top management with alignment to strategic goals.
    • More effective due to management support, but may overlook short-term concerns.
    • Bottom-up
    • Developed without management support; often reactive and focused on short-term issues.
    • Lack of alignment with strategic goals leads to ineffectiveness.

  • Administration and Supporting Controls

    • Specified information ownership.
    • Clearly defined staff responsibilities.
    • Established policies for handling asset/information access.

Security Management Concepts

  • Policies, Standards, Procedures

    • Policies: High-level organizational directives influencing decisions to achieve desired outcomes.
    • Standards: Mandatory requirements detailing processes and configurations to meet control objectives.
    • Procedures: Specific steps to implement standards and controls, ensuring compliance and consistency.

  • Control Objectives

    • Desired conditions to be achieved through controls. Maps directly to policies and standards.

  • Metrics

    • Provide data for evaluating program performance. Must be SMART (Specific, Measurable, Attainable, Relevant, Time-based).

Basic Security Concepts

  • Vulnerability: Weakness in an information system.
  • Threat: Scenario where a threat agent exploits a vulnerability causing damage.
  • Risk: Measure of likelihood and impact of a threat.
  • Countermeasure: Safeguard to prevent/mitigate risk.
  • Incident: Damage has occurred.

Security System Goals

  • Protecting Customers

    • Maintain secrecy and integrity of customer information.
    • Ensure customers access only their data based on contracts.

  • Protecting Service Providers

    • Maintain confidentiality and integrity of service provider data.
    • Implement strict access controls to limit unauthorized access.

  • Protecting Infrastructure

    • Use least privilege to minimize unauthorized data access.
    • Support for confidentiality, integrity, and availability (CIA) principles.

Security Principles

  • CIA Principles
    • Confidentiality: Ensures secrecy of data both at rest and in transit; safeguarded through encryption and access controls.
    • Integrity: Accuracy of information, ensuring no unauthorized modifications through error detection techniques and digital signatures.
    • Availability: Ensures adequate functionality and predictable performance, with contingency plans for disruptions.

Security Models

  • Bell-LaPadula Model

    • Focuses on confidentiality with multilevel security; defines access control rules based on classification levels.
    • Rules:
    1. No read up (cannot access higher security levels)
    2. No write down (cannot write to lower security levels)

  • Biba Model

    • Concentrates on data integrity; prohibits unauthorized or improper modifications.
    • Rules:
    1. No write up
    2. No read down

  • Clark-Wilson Model

    • Combines integrity goals to prevent unauthorized access and maintain consistency using separation of duties.

Data Protection Techniques

  • Data Backup

    • Types: Local, Server, Enterprise, Server-less.
    • Methods: Full, Differential, Incremental backups; rotation policies for data security.

  • Data Masking

    • Protects sensitive data while maintaining usability. Techniques include substitution, shuffling, and encryption.

  • Secure Data Erasure

    • Ensures all sensitive data is permanently removed from storage. Types include clearing, purging, and destroying data.

Common Attacks

  • Ransomware
    • Infects systems and encrypts files before demanding a ransom for decryption.
  • DDoS Attacks
    • Floods target servers with traffic, making services slow or inaccessible.
  • Data Exfiltration
    • Unauthorized copying or transferring of sensitive information out of an organization.