Untitled

• Module 2 discusses the five pillars of Information Security
• The learning outcome is to understand the Five Pillars of information Security

Introduction

• Computer systems comprising hardware, software, and data warrant security protection due to their inherent value.
• Computing devices can be involved in security incidents, regardless of their primary function
• Information security protects against and manages risks associated with the use, processing, storage, and transmission of data and information systems

Pillars of Information Security

• Confidentiality
• Integrity
• Availability
• Authentication
• Non-Repudiation

Confidentiality

• Confidentiality ensures assets are viewed only by authorized parties
• It involves high-level rules that limit access to all types of data and information
• It assures information is not disclosed to unauthorized individuals, groups, processes, or devices
• Authorized access to a data item is an example of failed confidentiality

Examples of Failed Confidentiality

• Accessing data items as an authorized person
• When an authorized process or program accesses data
• Authorized personnel access data outside their authorized scope such as a specialized version of an authorized data item
• Authorized personnel accessing approximate data such as confidential salary information
• An authorized person learning of a company’s new product development

Confidentiality Requirements include

• Implementing information classification
• Secure document storage
• Applying general security policies
• Educating information custodians and end-users
• Encryption to protect sensitive data at rest and in transit from unauthorized access which includes Caesar Cipher
• Using secure email networks that encrypt messages for authentication
• Implementing role-based access control (RBAC)
• Employing multi-factor authentication (biometric)
• Ensuring principle of least privilege
• Employing data masking to minimize exposure for non-administrators by masking or obfuscating critical information

Integrity

• Integrity ensures assets are modified only by authorized parties
• Accuracy and completeness of vital information must be safeguarded
• Integrity requires the information must be whole, complete, and uncorrupted
• Damages include corruption, damage, destruction, or other disruption of its authentic state
• Data corruption can happen during transmission or storage
• Viruses and worms corrupt data

Methods for detecting virus or worms

• Checking the file size
• File hashing; the file is read by a special algorithm that uses the value of the bits in the file to compute a single large number called a hash value
• An example of file hashing is MD5, SHA-1

How to use hashtaging command

• Open Command prompt or type CMD
• Type the command certutil -hashfile "path/to/your/file.txt" MD5
• This generates the MD5 hash value for the file path "path/to/your/file.txt"

Examples of ensuring integrity

• Implementing data Validation to ensure data is accurate, complete and up-to-date
• Implementing hashing algorithms to verify the integrity of the data and detect unauthorized alterations or tampering
• Deploying audit logs of data access and modifications to track unauthorized or suspicious activities

Availability

• Availability ensures that an asset can be used by any authorized parties
• Its means guaranteeing reliable access to information by authorized personnel
• Responsible users file desktop documents for easy access
• Hard copies should be filed securely and not left lying around
• Copies should be made to ensure important Documents are not lost
• Data is shared not only within organizations, but also to individuals outside the organization
• Email is a quick and easy way of sharing data, but information sent over the internet can be intercepted by hackers, compromising confidentiality
• Proper availability includes authorized users having easy access to information services
• IT resources and infrastructure should remain robust and fully-functional at all times during database issues and fall-overs
• Protection is required against malicious codes, hackers, and other threats that could block access to the information system

Examples of ensuring availability

• Building redundant systems such as backup power, networking, and data storage to ensure systems remain available
• Drafting disaster Recovery Plans clearly outline recovering data during attacks
• Establishing incident response to act quickly and limit system downtime during security breaches or attacks

Authenticity

• Authenticity confirms the sender's identity
• The source or origin of data is validated, and other file transfers through proof of identity
• Ensures the message was not corrupted and intercepted during transmission

The Authentication Process

• Users can verify their identities by providing specific credentials using Strong Authentication Protocol
• Login information (username and password)
• Biometric data
• Electronic or digital signature
• Authentication tokens
• Smart cards
• Authorization level: properly define and implement use of roles and permission to ensure of the authorized user can access sensitive systems and data
• Privilege List: A directory showing all permitted privileges or access rights for a given subject

Electronic Signature vs Digital Signature

• Electronic Signature Examples
• PDF Digital Signature Example
• Email Digital Signature Example

Non-Repudiation (or Accountability)

• Confirms that a sender cannot convincingly deny having sent something
• It proves the legitimacy of a message or data transfer by providing undeniable evidence of both authenticity and integrity
• It prevents someone from denying sent or received information

How Non-Repudiation Works

• Digital signatures where the customer signs a transaction with a private key
• The merchant can then verify with the customer’s public key
• Logging records who did what and when in a system
• Third parties such as a notary or forensic analyst verify the identity of the signer

Requirements include

• Using digital signatures by employing public-key cryptography to verify the identity of the sender as well as the message integrity.
• Applying time-stamping to record the exact time of a transaction to prevent backdating or future-dating
• Employing the Public Key Infrastructure (PKI) to establish a framework that issues public and private keys
• Logging Audit Trails to maintain detailed logs of all interactions with a document
• Using Storage facilities along w/ Write Once Read Many (WORM) drives to prevent unauthorized alterations to log records

Use cases

• E-commerce transactions ensure that customer cannot deny their purchase later
• In Business-to-Business transactions, senders and receivers alike cannot deny that they’ve sent of received a message
• Signing Contractual agreements where one cannot unilaterally deny the terms of the agreement after signing it

Definition of Non-Repudiation and Authenticity

• Authenticity is a process that ensures and confirms a user’s identity
• Non-repudiation refers to the assurance that the owner of a signature key pair capable of generating an existing signature corresponding to certain data cannot convincingly deny having signed the data

Security Property and Meaning

• Availability ensures information is ready for use and at the required performance level
• Integrity guarantees data and systems are only accessible or modifiable by authorized users
• Authentication validates that users are who they say they are (users/name, password, digital certificate)
• Confidentiality is a limit access policy (or places restrictions) on sensitive data like personally identifiable information or classified corporate data
• Non-repudiation ensures individuals cannot deny any action because a system provides proof of the action