Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
security concepts
fundamentals of sec pt2
| Question | Answer |
|---|---|
| zero trust | security model that operates on the principle that no one, whether inside outside the organization, should be trusted by default. Control plane, data plane. |
| control plane | adaptive identity, threat scope reduction, policy-driven access control, and secured zones |
| data plane | focused on subject/ , policy engine, policy, administrator, and establishing policy enforcement points |
| Threat | Anything that could cause harm, loss, damage, or compromise to information technology systems |
| identify 4 threats | Natural disasters, cyber attacks, data, integrity, breaches, disclosure of confidential information |
| define vulnerability and name 5. | Any weakness in the system designed or implementation. Software bugs, misconfigured software, improperly, protected network devices, missing security patches, lack of physical security |
| Threat + no vulnerability = ? vulnerability + no threat = ? | No risk |
| risk management | Finding different ways to minimize the likelihood of an outcome, occurring in achieving the desired outcomes |
| confidentiality | refers to the protection of information from unauthorized access and disclosure |
| Give three reasons why confidentiality is important? | protect personal privacy, maintain a business advantage, achieve regulatory compliance |
| what regulatory compliance? | PII, PHI, Various types of financial data |
| How to ensure confidentiality | encryption, access controls, data masking, physical security measures, training and awareness |
| define encryption | process of converting data into code to prevent unauthorized access |
| define access controls | ensure only authorized personnel can access certain types of data |
| data masking | Method that involves obscuring data within a database to make it inaccessible for unauthorized users, while retaining the real data, authenticity and use for authorized users |
| physical security measures | Used to ensure confidentiality for physical types of data and for digital information contained on servers and workstations |
| training and awareness | Conducting regular training on the security awareness, best practices that employees can use to protect the organization, sensitive data |
| What is integrity | Helps to ensure information and data remain accurate and unchanged from the original state unless intentionally modified Betre an authorized user |
| why is integrity important? | Ensure data accuracy, maintain trust, ensure system operability |
| how to maintain data integrity? | hashing, digital signatures, checksums, access controls, regular audits |
| hashing | Process of converting data into a fixed size value. Hash digest, digital fingerprint |
| digital signatures | Using encryption to ensure integrity and authenticity |
| checksums | method to verify the integrity of data during transmission |
| access controls | Ensure that only authorize individuals can modify data and reduce the risk of unintentional or malicious alterations |
| regular audits | involve reviewing logs and operations to ensure that only authorize changes have been made and any discrepancies are addressed |
| availability | Used to ensure the information systems, and resources are accessible and operational when needed by authorized users. |
| what's 99.999% (5 nines)?` | system guarantees a downtime of no more than 5.26 minutes in a year. 5.26 minutes per day |
| server redundancy | Involves using multiple servers in a load balance so that if one is overloaded or fails, the other servers can take over the load to continue supporting and users |
| redundancy | Duplication of critical components, or functions of a system with the intention of enhancing its reliability |
| data redundancy | Involves storing data in multiple places |
| what is availability? | Systems are always ready for use when they're needed. network redundancy, data redundancy, server redundancy, power redundnacy |
| power redundancy | Involves using backup power sources to ensure that an organization's systems remain operational during periods of power, disruption or outages within a local service area |
| What is non-repudiation? | Focus on providing undeniable proof in digital transactions. |
| define digital signature | Created by first hashing a particular message or communication to be digitally signed and encrypting the hash digest with the user's private key using asymmetric encryption |
| why is non-repudiation important? | confirming the authenticity of digital transactions, ensuring integrity, providing accountability |
| What's authentication? | Security measure that ensures individuals or entities are who they claim to be during a communication or transaction. |
| five common authetication methods | something you know (password), have( possession, badge. etc.), are(physical or behavioral characteristic), do(action, handshake, etc), somewhere you are (geographic location) |
| Multi factor authentication (MFA) | Security process that requires users to provide multiple methods of identification to verify their identity |
| Whats authorization? | Permission and privileges granted to users or entities after they have been authenticated |
| Define accounting | Security measure that ensures all User activities are properly tracked, and recorded. Transparency, security, accountability. Audit trail, regulatory compliance, forensic analysis, resource optimization, user accountability |
| audit trail | Provides a chronological record of all user activities that can be used to trace changes, unauthorized access, or anomalies back to a specific User or point in time |
| regulatory compliance | maintains a comprehensive record of all the users activities |
| forensic analysis | Uses detailed accounting and event logs that can help CyberSecurity experts, understand what happened, how it happened, and how to prevent similar incidents from occurring again in the future |
| resource optimization | Organizations can optimize system performance and minimize cost by tracking resource utilization and allocation decisions |
| user accountability | thorough accounting system ensures users' actions are monitored and logged, deterring potential misuse, and promoting adherence to the organizations policies |
| name three accountability systems? | syslog serves, network analysis tools, SIEMs |
| syslog servers | Used to aggregate logs from various network devices and systems so that system administrators can analyze them to detect patterns or anomalies in the organization systems |
| network analyzers | Used to capture and analyze network traffic to gain detailed insights into all the data moving within a network |
| security information and event management (SIEM) | Provides real-time analysis of security alerts generated by various hardware and software infrastructures in an organization |
| what are security controls categories? | Technical controls, managerial controls, operational controls, physical controls |
| technical controls | The technologies, hardware, and software mechanisms that are implemented to manage and reduce risks. Firewalls, encryption processes, intrusion detection systems |
| managerial controls (admin controls) | Involve the strategic planning and governance side of security. security policies, training programs, and incident response strategies |
| operational controls | Procedures and measures that are designed to protect data on a day-to-day basis and are mainly governed by internal processes and human actions. Backup procedures, account reviews, user training programs. |
| physical controls | Tangible, real-world measures taken to protect assets. Shredding of sensitive documents, security guards, locking the doors. |
| What are security control types? | preventative, deterrent, detective, corrective, compensating, directive |
| preventative controls | Proactive measures implemented to thro potential security threats for breaches |
| deterrent controls | Aim to discourage potential attackers by making the effort seem less appealing or more challenging (ADT security sign, warning signs, banners installed on websites) |
| detective controls | monitor and alert organizations to malicious activities as they occur or surely thereafter ( security cameras) IDS system (data spike) |
| corrective controls | Mitigate any potential damage and restore the system to their normal state. Antivirus software. |
| compensating controls | Alternative measures that are implemented when primary security controls are not feasible or effective. Running a legacy system, use VPN to protect system. WPA3 |
| directive controls | Often rooted in policy or documentation and set the standards for behavior within an organization. acceptable use policy (AUP) |
| Define zero trust | demands verification for every device, user, and transaction within the network, regardless of its origin. Control plane, data plane |
| Control plane | overarching framework and set of components, responsible for defining, managing, and enforcing the policies related to User and system access within an organization. Adaptive identity, threat scope reduction, policy-driven access control, secured zones |
| adaptive identity | Using adaptive identities that rely on real time validation that takes into account, the users behavior, device, location, and more |
| threat scope reduction | Limited users access to only what they need for their work tasks because this drastically reduces the networks potential attack surface |
| policy-driven access control | Entails developing, managing, and enforcing User Access policies based on their roles and responsibilities |
| secured zones | Isolated environments within a network that are designed to have sensitive data |
| policy engine | Cross-reference the access request with its predefined policies |
| policy administrator | Used to establish and manage the Access policies |
| what does the data plane consist of? | Consists of subject/system and policy enforcement point |
| subject/system | Refers to the individual or entity attempting to gain access. Verify authenticity of the subject or system before granting access to sensitive data and systems. |
| Policy enforcement point | Allow or restrict access, and it will effectively act as a gatekeeper to the sensitive areas of the system or network |
| what's a Gap analysis | Process of evaluating the differences between an organizations current performance and its desired performance. Organizations looking to improve their operations, process, performance or overall cybersecurity posture. powerful tool, security, performance |
| What are the steps involved in a gap analysis | 1. define he scope of the analysis (identifying specific areas of the org that will be evaluated, and the desired outcome of the analysis. 2. Gather data on the current state of the org. (surverys, interviews, analyze data, does it fall short?) |
| gap analysis steps cont. | 3. analyze the data to identify the gaps (analyze from step 2). 4. Develop a plan to bridge the gap (changes to the processes, systems, other areas of the organization that can help improve security of your systems and networks. Goals and objectives) |
| Two types of gap analysis | technical gap analysis, business gap analysis |
| technical gap analysis | Involves evaluating an organizations, current technical infrastructure and identifying any areas where it falls short of the technical capabilities required to fully utilize security solutions |
| technical gap analysis example | company's current network infrastructure is not fast enough to support data transit encryption or a full zero trust architecture, current security protocols are not robust enough to protect the data being stored at rest inside cloud based storage solution |
| business gap analysis | Evaluating and organizations current business processes and identifying any areas where they fall short of the capabilities required to fully utilized cloud based solutions. Current processes not sufficient, forecasting budgeting not accurate enough. |
| business gap analysis example | Vulnerability assessment across the entire network and systems. Found several offer vulnerabilities in different servers, etc. |
| plan of actin and Milestones (POA&M) | Outlines a specific measures to address each vulnerability, allocate resources, and set up timelines for each remediation task that is needed. Allows companies to prioritize the patching of critical software vulnerabilities and updating those databases |
Created by:
user-2044395