Cyber Security and Risk Management Module 1 & 2

Module 1

• Information security is the practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording, or destruction of sensitive records.
• Cyber security applies technologies, processes, and controls to protect systems, networks, programs, devices, and data from cyber-attacks.
• Costs of cyber security breaches are increasing.
• Cyber-attacks are becoming more sophisticated.
• Cyber security is a critical business issue.
• Cybercrime is a large business.
• Common cyber threats include malware (ransomware, botnet software, trojan), backdoors, form jacking, cryptojacking, DDoS (Distributed Denial-of-Service) attacks, and DNS (Domain Name System) Poisoning attacks.
• Types of cyber security include network security, cloud security, IoT security, and application security.

Module 2

• Risk management is a continuing process to identify, analyze, evaluate, and treat loss exposure, and monitor risk control to mitigate losses.
• Steps to manage SDLC risk:
  • Define risk management plan (risk identification, analysis, implementation, monitoring, and improvement)
  • Identify and document risks (brainstorming, interviews, surveys, checklists, historical data, expert opinions)
  • Analyze and prioritize risks (risk matrices, simulations, decision trees)
  • Plan and implement risk responses (avoid, transfer, mitigate, accept)
  • Monitor and control risks
  • Learn and improve from risks
• A risk register helps track identified risks in software.

Module 3

• Risk management plan details an organization's risk approach, roles of risk management teams, resources for the process, and internal policies/procedures.
• Three Major Processes in Risk Management:
  • Risk identification
  • Risk assessment
  • Risk control
• Four basic threat categories: insider threats, external threats, man-made threats, and natural disasters.

Module 4

• Risk assessment methodologies include both qualitative and quantitative methods.
• Qualitative: Descriptions, quicker, less rigorous, subjective results.
• Quantitative: Numbers, measurable, more rigorous, objective results.
  • SLE (Single Loss Expectancy) calculation: Asset Value (AV) * Exposure Factor (EF)
  • ALE (Annual Loss Expectancy) calculation: SLE * Average Rate of Occurrence (ARO)
• Information Assurance (IA) protects data integrity, availability, authenticity, non-repudiation, and confidentiality
• Information security protects against unauthorized access, use, disclosure, disruption, modification or destruction of data.
• Differences between IA and IS: IA is concerned with overall organizational risk and standards, while IS focuses on methods to reduce risks.

Module 5

• Information assurance is the practice of assuring and managing risks related to confidential information throughout the process of transmission, processing, and storing data.
• Key characteristics of information assurance include availability, integrity, authentication, confidentiality and non-repudiation of data.
• Information assurance is more focused on organizational risk management and data quality while information security focuses on technical solutions to reduce risks.

Module 6

• Security controls are countermeasures to reduce threats exploiting vulnerabilities.
• Risk mitigation is reducing the likelihood that a threat will exploit a vulnerability, resulting in loss.
• Threats are events that compromise confidentiality, integrity, and availability.
• Vulnerabilities are weaknesses or flaws in hardware, software, or organizational processes.
• Security incidents are occurrences that jeopardize CIA of information systems or violate security policies.
• Types of security controls:
  • Physical: Walls, locks, surveillance.
  • Administrative: Policies/procedures.
  • Technical: Software, firewalls, encryption, access control.
• Configuration rules, administrative controls, and physical security controls to prevent unauthorized access.