Introductory IC-02 Information Security

Core Principles of Information Security

• CIA is an acronym for Confidentiality, Integrity, and Availability, fundamental concepts in information security.

Confidentiality

• Involves sharing information exclusively with authorized individuals.
• Maintained through authentication techniques and access permissions.

Integrity

• Ensures data reliability, consistency, and accuracy.
• Protects against unauthorized modifications using methods like hashing and checksums.

Availability

• Guarantees that authorized users can access data and services as needed.
• Achieved through strategies such as load balancing, regular backups, and off-site storage for recovery.

Vulnerabilities

• Defined as flaws or weaknesses in software or hardware that can be exploited.
• Exploitations may occur through both software and hardware components.

Causes of Vulnerabilities

• Human Factor: A major source of vulnerabilities; humans can inadvertently cause breaches through poor security practices.
• Misconfiguration: Commonly arises from incorrect application settings.
• Complexity: Larger organizations with complex systems are more prone to vulnerabilities.
• Connectivity: Increased vulnerabilities stem from physical connections and open port protocols.
• Unsuitable Security Policies: Weak security policies can lead to unauthorized access and poor password choices.
• Lack of Input Validation: Failure to validate user input can create critical vulnerabilities.

Vulnerability Assessment

• The process of defining, identifying, classifying, and prioritizing vulnerabilities in a network.

Hacking

• The act of exploiting or identifying weaknesses in a network or system.
• Any internet-connected device can be targeted for hacking.

Types of Hackers

• Hacker: Individuals who manipulate systems for ulterior purposes.
• Hacker Skills: Key competencies include knowledge of Linux, Windows, networking, programming, and security mechanisms.
• Unethical Hackers: Operate for personal or financial gain, often using their expertise to exploit systems.
• Ethical Hackers: Also known as "white hat" hackers, they use skills for legitimate purposes, focusing on testing and improving security.
• Grey Hat Hackers: Operate in the space between ethical and unethical, assessing vulnerabilities without explicit permission but alerting organizations when issues are found.

Incident Response

• Details the procedures for managing a cybersecurity incident promptly.
• Aims to contain threats and minimize damage, with information gathered used for forensic analysis.

Incident Response Team (IR Team)

• Engages during cyber attacks to protect critical company assets.

IR Guidelines

• Six crucial steps for incident response: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.

NIST Risk Management Framework (RMF)

• A structured process consisting of steps: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor to manage and mitigate risks.