Fundamental Security IX

Fundamental Security IX

• Information security is critical in today's digital world. Adopting fundamental principles like least privilege, encryption, access controls, and a security-conscious culture is essential to protect against threats and maintain data privacy, integrity, and availability.
• A secure information system is fundamental to building a secure information system and protecting sensitive data from threats and vulnerabilities.
• A secure information system relies on several essential components and must be designed to address various security threats and vulnerabilities.
• Cybersecurity consists of technologies that keep computer systems and electronic data safe. Business and social lives are increasingly online.
• Data protection safeguards personal data, financial data, medical and private property for unauthorized access.
• Without security measures, sensitive data can be stolen, leading to identity theft, fraud, and exposure of sensitive information.
• Cyberattacks and data breaches expose private information, which can be used for blackmail, discrimination, cyberbullying, or to invade personal privacy. Strong security protects personal privacy.
• Securing communication and information involves mathematical techniques and algorithms to protect data from unauthorized access and tampering.
• Encryption converts readable data (plaintext) into coded data (ciphertext) using an algorithm and a key.

Examples of Security

• Antivirus programs detect, prevent and remove malicious software, playing a critical role in protecting systems from threats.
• Firewalls act as the first line of defense by monitoring and controlling incoming and outgoing network traffic based on security rules.

Reasons to Use Antivirus Software

• Detecting, preventing, and removing viruses and malware that damage devices.
• Blocking annoying and dangerous pop-ups.
• Scanning systems and devices in real-time.
• Protecting external devices.
• Blocking scam sites.
• Making devices faster.

Types of Authentication

• SMS/Email codes
• Password
• Fingerprint
• Face Verification
• Voice

Strong Password Policies

• Passwords must have at least one letter.
• Passwords must have at least one capital letter.
• Passwords must have at least one number.

Security Threats

• A security threat is a malicious act that aims to corrupt or steal data, or disrupt systems, or entire organizations.
• A security event is an occurrence where a company's data or network may have been exposed.
• Insider threats occur when authorized individuals misuse their access to negatively affect critical data or systems.
• Viruses and worms are malicious software programs aimed at destroying systems, data, and networks.
• Botnets are collections of infected Internet-connected devices (Pcs, mobile devices, servers, and IoT devices) remotely controlled by malware.
• In a drive-by download attack, malicious code is downloaded from a website without user permission or knowledge.
• Phishing attacks employ social engineering to trick users into breaking security practices and giving up confidential information.
• Ransomware attacks lock victims' computers, typically by encryption, preventing access to the device or data.
• Exploit kits are toolkits used by cybercriminals to attack system vulnerabilities, distributing malware or performing malicious activities.
• Malvertising is a technique to inject malicious code into legitimate online advertising networks and web pages.

Types of IT Security Policies

• Organizational policies create company-wide blueprints for digital infrastructure policies.
• Issue-specific policies address specific issues such as who can make configuration changes to firewalls.
• System-specific policies protect particular systems such as a company's website backend, ensuring only authorized access.

Most Effective IT Security Policies

• Strict password management policies are essential for accessing important systems. These policies involve unique, strong passwords and guidelines for changing them securely.
• Acceptable user policies describe the appropriate use of computers, the internet, social media, email servers, and sensitive data.
• Follow the 3-2-1 rule for backup: maintain 3 copies of data, save on 2 different media, and store one backup off-premises for disaster recovery.

Common Preventive Maintenance Techniques

• Regular cleaning, lubrication, part replacement, and equipment repair.
• Scheduling requirements differ depending on the maintained equipment.
• The goal is to prevent equipment failure and reduce accidents.

Importance of Preventive Maintenance

• Lays the foundation for successful facility management.
• Keeps equipment and assets running smoothly.
• Maintains a high safety level for employees.
• Prevents large, costly repairs.
• Minimizes operational disruptions

Types of Preventive Maintenance

• Time-based maintenance (TBM) tasks are scheduled at set intervals e.g. every 10 days.
• Examples include regular inspections, critical equipment checks.
• Condition-based maintenance (CBM) monitors asset condition and proactively schedules maintenance tasks based on specific indicators.
• Examples include when vibrations reach a certain threshold, or thermal hotspots.
• Predictive maintenance (PDM) uses condition-monitoring to track equipment and performance. Maintenance is performed when thresholds are breached (i.e. monitoring vibration in bearings or checking for thermal hotspots).

Troubleshooting Network Security

• Identify the Problem: Gather information on symptoms, affected devices, network topology, and security policies.
• Isolate the Cause: Eliminate possible sources of the problem one-by-one.
• Implement a Solution: Apply a solution that resolves the problem and restores network security.
• Verify the Result: Ensure the solution has resolved the problem and network security is restored.
• Document the Process: Document the entire troubleshooting process, including problem details, cause, solution, and results.

Phishing Attack Detected

• Problem: User reports receiving a suspicious email asking for login credentials or financial information.
• Verification Steps: Ask the user to forward the email, check for phishing signs (grammar, unfamiliar email addresses, URLs), find out if user clicked any links, change the password immediately.
• Block the Source: Block the sender's domain/email address to prevent future phishing attempts.
• Monitor for Compromise: Check for unusual user activity, run antivirus/malware scans on affected machines.
• Educate the User: Provide security awareness training for future phishing attempts.

Confidentiality, Integrity, and Availability (CIA)

• Confidentiality: measures prevent sensitive information from unauthorized access. Data classification groups based on potential damage if compromised.
• Integrity: maintaining data consistency, accuracy, and trustworthiness throughout its lifecycle. Ensuring data can't be altered.
• Availability: Ensuring authorized parties have consistent and ready access to information, properly maintaining hardware and technological infrastructure.