Security and Risk Management Fundamentals

Security and Risk Management

• Security Fundamentals:
  • Confidentiality, Integrity, and Availability (CIA) triad
  • Security principles: least privilege, separation of duties, defense in depth
  • Security models: Bell-LaPadula, Biba, Clark-Wilson
• Risk Management:
  • Risk assessment: identifying, analyzing, and prioritizing risks
  • Risk treatment: acceptance, mitigation, transfer, avoidance
  • Risk monitoring and review
• Security Policy and Procedures:
  • Security policies: organizational, issue-specific, and system-specific
  • Procedures: incident response, disaster recovery, business continuity

Asset Security

• Protecting Sensitive Assets:
  • Data classification: public, internal, confidential, top secret
  • Data handling: storage, transmission, and destruction
  • Asset management: inventory, classification, and control
• Data Protection:
  • Encryption: symmetric, asymmetric, and hashing
  • Digital rights management (DRM)
  • Data loss prevention (DLP)
• Physical Security:
  • Physical access control: doors, locks, and biometrics
  • Surveillance and monitoring
  • Environmental controls: temperature, humidity, and power

Security Engineering

• Security Models and Architectures:
  • Secure/Multics, Bell-LaPadula, and Biba models
  • Trusted Computer System Evaluation Criteria (TCSEC)
  • Common Criteria (CC) and Evaluation Assurance Level (EAL)
• Cryptography:
  • Symmetric encryption: AES, DES, and Blowfish
  • Asymmetric encryption: RSA, elliptic curve, and Diffie-Hellman
  • Hash functions: SHA, MD5, and HMAC
• Secure Design Principles:
  • Secure by design and default
  • Least privilege and separation of duties
  • Defense in depth and layered security

Communication and Network Security

• Network Fundamentals:
  • OSI and TCP/IP models
  • Network architectures: LAN, WAN, Wi-Fi, and Internet
  • Network protocols: HTTP, FTP, SSH, and DNS
• Network Security:
  • Network access control: firewalls, intrusion detection, and access control lists
  • Network segmentation and isolation
  • Secure communication protocols: SSL/TLS, IPsec, and PPTP
• Wireless Security:
  • Wireless network security: WEP, WPA, and WPA2
  • Wireless threats: rogue access points, eavesdropping, and jamming

Identity and Access Management

• Identity Management:
  • Identity types: users, groups, and roles
  • Identity authentication: passwords, biometrics, and smart cards
  • Identity authorization: access control, permissions, and privileges
• Access Control:
  • Access control models: MAC, DAC, and RBAC
  • Access control mechanisms: authentication, authorization, and accounting
  • Access control protocols: Kerberos, RADIUS, and TACACS+
• Identity as a Service (IDaaS):
  • Cloud-based identity management
  • Identity federation and single sign-on (SSO)

Security Fundamentals

• Confidentiality, Integrity, and Availability (CIA) triad ensures data protection
• Security principles:
  • Least privilege: limiting access to necessary resources
  • Separation of duties: dividing tasks to prevent misuse
  • Defense in depth: multiple layers of security
• Security models:
  • Bell-LaPadula: access control and confidentiality
  • Biba: integrity and availability
  • Clark-Wilson: integrity and separation of duties

Risk Management

• Risk assessment:
  • Identifying potential risks
  • Analyzing likelihood and impact
  • Prioritizing risks
• Risk treatment:
  • Acceptance: taking no action
  • Mitigation: reducing risk
  • Transfer: sharing risk with others
  • Avoidance: eliminating risk
• Risk monitoring and review: continuous evaluation and improvement

Security Policy and Procedures

• Security policies:
  • Organizational: company-wide policies
  • Issue-specific: addressing specific security concerns
  • System-specific: security policies for individual systems
• Procedures:
  • Incident response: responding to security breaches
  • Disaster recovery: restoring systems after disasters
  • Business continuity: maintaining business operations during disasters

Asset Security

Protecting Sensitive Assets

• Data classification:
  • Public: unrestricted access
  • Internal: limited access
  • Confidential: restricted access
  • Top secret: highly restricted access
• Data handling:
  • Storage: secure data storage
  • Transmission: secure data transfer
  • Destruction: secure data disposal
• Asset management:
  • Inventory: tracking assets
  • Classification: categorizing assets
  • Control: controlling access to assets

Data Protection

• Encryption:
  • Symmetric: same key for encryption and decryption
  • Asymmetric: different keys for encryption and decryption
  • Hashing: one-way encryption for data integrity
• Digital rights management (DRM): controlling access to digital content
• Data loss prevention (DLP): detecting and preventing data breaches

Physical Security

• Physical access control:
  • Doors: controlling physical access
  • Locks: securing physical access
  • Biometrics: authentication through physical characteristics
• Surveillance and monitoring: monitoring physical environments
• Environmental controls:
  • Temperature: controlling temperature
  • Humidity: controlling humidity
  • Power: controlling power supply

Security Engineering

Security Models and Architectures

• Secure/Multics model: access control and confidentiality
• Bell-LaPadula model: access control and confidentiality
• Biba model: integrity and availability
• TCSEC: Trusted Computer System Evaluation Criteria
• Common Criteria (CC) and Evaluation Assurance Level (EAL): evaluating security

Cryptography

• Symmetric encryption:
  • AES: Advanced Encryption Standard
  • DES: Data Encryption Standard
  • Blowfish: symmetric encryption algorithm
• Asymmetric encryption:
  • RSA: asymmetric encryption algorithm
  • Elliptic curve: asymmetric encryption algorithm
  • Diffie-Hellman: key exchange algorithm
• Hash functions:
  • SHA: Secure Hash Algorithm
  • MD5: Message-Digest Algorithm 5
  • HMAC: Keyed-Hash Message Authentication Code

Secure Design Principles

• Secure by design and default:
  • Designing systems with security in mind
  • Default security settings
• Least privilege and separation of duties:
  • Limiting access to necessary resources
  • Dividing tasks to prevent misuse
• Defense in depth and layered security:
  • Multiple layers of security
  • Redundancy and fail-safes

Communication and Network Security

Network Fundamentals

• OSI and TCP/IP models: network communication protocols
• Network architectures:
  • LAN: Local Area Network
  • WAN: Wide Area Network
  • Wi-Fi: Wireless Fidelity
  • Internet: global network
• Network protocols:
  • HTTP: Hypertext Transfer Protocol
  • FTP: File Transfer Protocol
  • SSH: Secure Shell
  • DNS: Domain Name System

Network Security

• Network access control:
  • Firewalls: controlling network access
  • Intrusion detection: detecting unauthorized access
  • Access control lists: controlling access to network resources
• Network segmentation and isolation:
  • Segmenting networks for security
  • Isolating networks for security
• Secure communication protocols:
  • SSL/TLS: Secure Sockets Layer/Transport Layer Security
  • IPsec: Internet Protocol Security
  • PPTP: Point-to-Point Tunneling Protocol

Wireless Security

• Wireless network security:
  • WEP: Wired Equivalent Privacy
  • WPA: Wi-Fi Protected Access
  • WPA2: Wi-Fi Protected Access 2
• Wireless threats:
  • Rogue access points: unauthorized access points
  • Eavesdropping: intercepting wireless transmissions
  • Jamming: disrupting wireless communications

Identity and Access Management

Identity Management

• Identity types:
  • Users: individual identities
  • Groups: collections of users
  • Roles: predefined identities
• Identity authentication:
  • Passwords: password-based authentication
  • Biometrics: authentication through physical characteristics
  • Smart cards: authentication through smart cards
• Identity authorization:
  • Access control: controlling access to resources
  • Permissions: controlling access to resources
  • Privileges: controlling access to resources

Access Control

• Access control models:
  • MAC: Mandatory Access Control
  • DAC: Discretionary Access Control
  • RBAC: Role-Based Access Control
• Access control mechanisms:
  • Authentication: verifying identities
  • Authorization: controlling access to resources
  • Accounting: tracking access to resources
• Access control protocols:
  • Kerberos: authentication protocol
  • RADIUS: Remote Authentication Dial-In User Service
  • TACACS+: Terminal Access-Control Access-Control System Plus

Identity as a Service (IDaaS)

• Cloud-based identity management:
  • Cloud-based identity services
• Identity federation and single sign-on (SSO):
  • Federating identities across organizations
  • Single sign-on for multiple systems

Security Fundamentals

• Confidentiality, Integrity, and Availability (CIA Triad) are fundamental principles of information security.
• Confidentiality protects sensitive information from unauthorized access.
• Integrity ensures data accuracy and completeness.
• Availability ensures timely and reliable access to data and systems.

Risk Management

• The Risk Management Process involves four stages: Risk Identification, Risk Assessment, Risk Mitigation, and Risk Monitoring.
• Risk Identification involves identifying potential risks and threats.
• Risk Assessment evaluates the likelihood and impact of identified risks.
• Risk Mitigation implements controls to reduce risk.
• Risk Monitoring involves ongoing monitoring and review of the risk management process.

Risk Analysis

• Qualitative Risk Analysis involves a subjective evaluation of risk likelihood and impact.
• Quantitative Risk Analysis involves an objective evaluation of risk using numerical values.

Threat Modeling

• Threat Modeling involves identifying and evaluating potential threats to an organization.
• The STRIDE Threat Model identifies threats to confidentiality, integrity, and availability.
• The DREAD Threat Model evaluates threat likelihood and impact.

Security Policies and Procedures

• A Security Policy is a high-level document outlining an organization's security objectives and requirements.
• Security Procedures are detailed, step-by-step guides for implementing security policies.
• Standards and Guidelines are specific, mandatory requirements for security controls and procedures.

Compliance and Regulations

• Compliance involves adhering to laws, regulations, and industry standards.
• Regulatory Requirements involve meeting specific legal and regulatory obligations (e.g. HIPAA, PCI-DSS).
• Audit and Compliance involve ensuring adherence to regulations and standards through regular audits and assessments.