Cybersecurity Principles Quiz

Cybersecurity Fundamentals (Part 2)

• Cybersecurity is based on generally accepted best practices to implement effective measures
• Principles include Security by Design, Defense in Depth, Least Privilege, and Zero Trust
• Security by Design: Security is built into the design and development from the start; not added as a response
  • Goal: Design security within the system or application.
  • Utility: Prevents vulnerabilities and reduces the need for retroactive security measures
  • Achieved by: Security assessments, code reviews, and security education of developers
• Defense in Depth: Implementing multiple layers of security controls to protect against various threats.
  • Goal: Design complementary controls so that a security breach in one layer doesn't compromise the entire system.
  • Utility: Reduce impact of single points of failure and enhances security robustness
  • Achieved By: Using a combination of technologies, access controls, and monitoring across various IT infrastructure levels like physical, network, hosts, users, and data
• Least Privilege: System elements should have the minimum level of access/permissions for authorized tasks.
  • Goal: Reduce attack surface and limit damage from accidental or intentional breaches.
  • Utility: Minimize risk of unauthorized access or misuse, and limit damage from insider threats or compromised accounts
  • Achieved by: Restrictions on administrative privileges, use of role-based access control (RBAC), access control lists (ACLs), and regular access privilege review
• Zero Trust: Trust is never assumed, even for internal users or devices; verification required for all access.
  • Goal: Protect critical resources from unauthorized access and reduce attack surface by verifying the identity.
  • Utility: Enhances security by verifying trustworthiness of users, devices, and apps before access.
  • Achieved by: Identity verification, Least Privilege Principle, and continuous activity monitoring of users, endpoints, applications, and networks

Data Security

• Focuses on protecting data from unauthorized access, disclosure, alteration, or destruction.
  • Goal: Ensure sensitive information remains confidential, maintains its integrity, and is available when needed.
  • Typical Vulnerabilities/Weaknesses: Unauthorized access, data leakage/exfiltration, data integrity threats, and lack of data backups
  • Countermeasures: Data encryption (both in transit and at rest), authentication measures (multi-factor, password policies), access controls (authorization, least privilege), data classification, data loss prevention (DLP), backup and recovery

Data Encryption

• Fundamental for protecting sensitive information from unauthorized access, disclosure, and tampering.
  • Methods: Transformation (encryption) of data into an unreadable format (ciphertext)
  • Data encryption protects confidentiality by keeping data unreadable without a key.
  • Types: Symmetric (same key for encryption and decryption), Asymmetric (different keys for encryption and decryption), and Hybrid (combines both methods to improve efficiency and security)

Additional Data Encryption Information

• Symmetric Encryption: Fast but requires sharing the secret key securely. Uses AES, DES, 3DES. Efficient for securing data at rest and in transit
• Asymmetric Encryption (Public Key): Different keys for encryption and decryption, no secret sharing is required. More versatile and used in key exchange (HTTPS), digital signatures (verification), and certificate-based authentication. Uses RSA and ECC
• Hybrid Encryption: Combines both symmetric and asymmetric encryption methods to take advantage of both. Efficient for actual data transfers using symmetric; uses asymmetric to exchange secret keys.

Test your understanding of fundamental cybersecurity principles such as least privilege, security by design, and defense in depth. This quiz covers the importance of roles, redundancy, and security assessments to enhance overall security. Perfect for students and professionals looking to solidify their knowledge in information security.