Cybersecurity Functions Overview

Study Notes

Identify: Establish security policies, evaluate risks, and recommend security measures to handle vulnerabilities.
Protect: Ensure security is integrated at every stage of IT hardware and software lifecycle management.
Detect: Conduct continuous monitoring to maintain and verify the effectiveness of security controls against evolving threats.
Respond: Actively identify and analyze security threats, focusing on containment and eradication.
Recover: Establish resilience strategies to restore systems and data after security failures or attacks.

Detection to Protection: Start with identifying attacks and then focus on implementing protective measures.
Respond and Recover to Protection: Enhance security measures based on lessons learned from responding to and recovering from incidents.
Feedback Loop: Utilize detection and response insights to improve future threat identification.

Defense at Identification Level: Protect against external threats primarily through effective identification methods.

Identification: Verify user identity and create user accounts for representation.
Authentication: Users enter credentials, which are matched against securely stored hashed credentials.
Authorization: Confirm user permissions through an Access Control List (ACL) for each action performed.
Accounting: Log user actions to ensure accountability and prevent denial of actions.

Identification: Verify customer legitimacy using billing, delivery address checks, and fraud detection on payment methods.
Authentication: Ensure each customer has a unique account for managing orders and billing securely.
Authorization: Set payment method validation and enforce rules for loyalty schemes, allowing specific customers exclusive access to offers.
Accounting: Maintain records of customer actions to prevent denial of orders placed.

Definition: Protects data from unauthorized access, attacks, theft, or damage.
Vulnerabilities: Data can be at risk based on its storage, transfer, or processing methods.
CIA Triad:
- Confidentiality: Restricts data access to authorized individuals.
- Integrity: Ensures data remains unaltered unless permitted through authorized processes.
- Availability: Guarantees information remains accessible to those authorized.

Purpose: Identify discrepancies between an organization’s existing security systems and those required by a framework.
Implementation: Performed during initial framework adoption or compliance assessments, typically revisited every few years.
Gap Analysis Report Components:
- Overall performance score.
- Detailed account of missing or improperly configured security controls.
- Recommendations for remediation actions.