Security Fundamentals: CIA Triad & Key Concepts

Fundamentals of Security

• Information security protects data and information from unauthorized actions.
• Information systems security protects the systems holding and processing critical data.
• The CIA Triad consists of Confidentiality, Integrity, and Availability.
  • Confidentiality ensures access to information is limited to authorized personnel through methods like encryption.
  • Integrity ensures data remains accurate and unaltered, often using checksums.
  • Availability ensures information and resources are accessible when needed via redundancy measures.
• Non-Repudiation guarantees actions or events cannot be denied by involved parties via digital signatures.

Security Concepts

• The CIANA Pentagon extends the CIA triad by adding non-repudiation and authentication.
• Triple A's of Security refer to Authentication, Authorization, and Accounting.
  • Authentication verifies the identity of a user or system using password checks.
  • Authorization determines the actions or resources an authenticated user can access, including permissions.
  • Accounting tracks user activities and resource usage for audit or billing purposes

Security Controls

• Security control categories include:
  • Technical: Technologies, hardware, and software mechanisms that manage and reduce risks.
  • Managerial: Administrative controls involving strategic planning and governance.
  • Operational: Procedures and measures protecting data daily, governed by internal processes and human actions.
  • Physical: Tangible, real-world measures protecting assets.
• Security control types include:
  • Preventative: Proactive measures to thwart potential security threats or breaches.
  • Deterrent: Measures discouraging attackers by making their effort less appealing.
  • Detective: Controls that Monitor and alert organizations to malicious activities
  • Corrective: Measures mitigating damage and restoring systems to normal.
  • Compensating: Alternative measures when primary security controls are ineffective.
  • Directive: Actions that Guide or mandate.
• The Zero Trust Model assumes no entity should be trusted by default.

Zero Trust Implementation

• Achieving zero trust requires both a control plane and a data plane.
• The Control Plane offers adaptive identity, threat scope reduction, policy-driven access control, and secured zones.
• The Data Plane deals with the subject/system, policy engine, policy administrator, and establishing policy enforcement points.

Threats and Vulnerabilities

• A threat is anything causing harm, loss, damage, or compromise to IT systems from natural disasters, cyber-attacks, breaches, etc.
• A vulnerability is any weakness in system design or implementation, including software bugs, misconfigurations, improper protection, missing patches, etc.
• Risk arises where threats and vulnerabilities intersect.
• Risk management minimizes the likelihood of negative outcomes.

Confidentiality Measures

• Confidentiality ensures information is protected from unauthorized access and disclosure, maintaining privacy and regulatory compliance.
• Methods to ensure confidentiality include:
  • Encryption: Converting data into a code to prevent access.
  • Access Controls: Setting up user permissions for authorized personnel only.
  • Data Masking: Obscuring specific data within a database while retaining authenticity for authorized users.
  • Physical Security Measures: Protecting physical data like paper records and digital data on servers/workstations.
  • Training and Awareness: Educating employees on security awareness best practices.

Maintaining Integrity

• Integrity ensures data remains accurate and unchanged, verifying its trustworthiness.
• Five methods to maintain integrity include:
  • Hashing: Converting data into a fixed-size value
  • Digital Signatures: Validating integrity and authenticity.
  • Checksums: Verifying data integrity during transmission.
  • Access Controls: Allowing modifications only by authorized individuals to avoid unintentional alterations.
  • Regular Audits: Reviewing logs and operations for unauthorized changes.

Ensuring Availability

• Availability ensures that information, systems, and resources are accessible and operational when needed.
• Availability helps with business continuity, customer trust, and upholding an organization's reputation.
• Redundancy involves duplicating critical components or functions to enhance reliability.

Redundancy Types

• Types of redundancy to consider in system design:
  • Server Redundancy: Using multiple servers in load-balanced or failover setups.
  • Data Redundancy: Storing data in multiple places.
  • Network Redundancy: Ensuring data can travel through another if one network path fails.
  • Power Redundancy: Using backup power sources like generators and UPS.

Non-Repudiation and Authentication

• Non-repudiation provides undeniable proof of actions or communications.
• Digital signatures are unique to each user, created using asymmetric encryption.
• Authentication ensures individuals are who they claim to be.
• Five common authentication methods:
  • Something you know (Knowledge Factor): Using information a user can recall.
  • Something you have (Possession Factor): Presenting a physical item.
  • Something you are (Inherence Factor): Using unique physical traits.
  • Something you do (Action Factor): Performing a unique action.
  • Somewhere you are (Location Factor): Being in a specific geographic spot.

Authentication, Authorization, and Accounting

• Multi-Factor Authentication (MFA) requires users to provide multiple identification methods.
• Authentication prevents unauthorized access and protects data, ensuring valid user access.
• Authorization grants permissions and privileges after authentication.
• Authorization mechanisms protect sensitive data and maintain system integrity.
• Accounting measures track and record all user activities during communications or transactions.
• Robust accounting systems create audit trails, maintain regulatory compliance, and conduct forensic analysis.

System Logging

• Performing resource optimization is supported through thorough accounting and event logs, helping cybersecurity experts prevent future incidents.
• To perform accounting different technologies are used:
  • Syslog Servers: Aggregate logs from various devices for pattern detection.
  • Network Analysis Tools: Capture and analyze network traffic.
  • Security Information and Event Management (SIEM) Systems: Offers real-time analysis of security alerts from infrastructure.

Security Control Categories

• There are four broad categories of security controls:
  • Technical Controls: Involve hardware and software to reduce risks.
  • Managerial Controls: Strategic planning and governance.
  • Operational Controls: Focus on day-to-day data protection.
  • Physical Controls: Tangible measures to protect assets.

Security Control Types

• Security control types:
  • Preventive Controls: Stop threats or breaches proactively.
  • Deterrent Controls: Discourage attackers.
  • Detective Controls: Monitor activities detecting malicious acts
  • Corrective Controls: Mitigate damage and restore systems.
  • Compensating Controls: Alternative measures when primary controls fail.
  • Directive Controls: Guide/inform security actions.

Gap Analysis

• Gap Analysis evaluates the differences between current and desired performance.
• Steps for conducting a gap analysis: defining scope, gathering data, analyzing gaps, developing a plan.
• It can be useful tool for organizations looking to improve security posture.
• There are two basic types of Gap Analysis:

1. Technical Gap Analysis:

• Evaluates infrastructure, identifying shortfalls in utilizing security solutions.

2. Business Gap Analysis:

• Evaluates business processes, identifying shortfalls of capabilities required to fully utilize cloud based solutions
• A Plan of Action and Milestones (POA&M) outlines steps to address vulnerabilities, allocate resources, and set remediation timelines.

Zero Trust Model

• The zero-trust approach means verification is required for every device, user and transaction.
• To create a zero trust architecture, use the control and date plane

Zero Trust - Control Plane and Data plane

• Adaptive identity, threat scope reduction, policy-driven access control, and secured zones all define Zero Trust.
• The policy Engine ensures that the accesses request matches the pre-defined policies. It establishes and manages those access policies.
• Access is granted or denied at the policy enforcement point within a Zero Trust architecture.

Threat Actors and Motivations

• Threat Actor Attributes are used to classify threat factors, e.g., "Data Exfiltration" to describe the act of unauthorized data removed from a computer, or "Hacktivism" to describe attacks conducted because of philosophical of political reasons
• These types of attacks are associated with particular threat actors, from "Unskilled persons" using basic tools, to nation states actors cyber espionage.

Security Threats

• Cybercrime groups, in contrast to hacktivists, are well structured and resourced, aiming at illicit gain through advanced hacking, custom malware such as "Ransomware", and phishing"
• Internal threats should be treated as zero trust.

Securing IT Infrastructure

• Zero Trust Architecture, robust access controls, regular audits and other security elements go a long way to securing and protecting organizations.
• This also helps to avoid Shadow IT where information technology falls outside an organizations security program.

Identifying Threat Vectors

• Threat vectors and attack surfaces must be well understood to be mitigated. Threats may originate from:
  • messages
  • images
  • files
  • networks
  • physical devices

Deceptive Technologies

• Decoy technologies go a long way towards attracting and deceiving attackers.
• One strategy to accomplish is the creation of phony Domain Name System entries.

Safeguarding Physical Assets

• Tangible objects require physical security e.g., fences, locks, cameras.
• Security should be able to resist brute force attacks and tampering.

Understanding Security Controls

• Safeguarding assets utilizes security controls (Access control Vistbiules) to control physical access. Bypassing these involves:
• Visual obstruction of camera,
• Blinding sensors,
• Interfering of other electronics.
• Security should be able to resist piggy backing and tailgating.

Door Lock Security

• Pad locks are easily circumvented
• Electronic locks are better, biometric more secure.
• To protect against skimming you need to implement multifactor.

Social engineering

• Psychological attacks can be "social proof" where authority is assumed. Impersonation can be "brand based" to seem legitimate.
• You can protect against impersonation by using "secure email gateways".

Identifying Common Phishing Techniques

• Common phishing techniques include looking for tell-tales such as Urgency", Unusual Requests", and "Mismatched URLs."

Recognizing Spear Phishing Techniques

• Email Business Compromise (BEC)" is a form of sophisticated phishing that are used to get other employees to act maliciously and trick a user.

Preventing Email Borne Threats

• Prevention can be achieved thought training to spot those threats, as well as Anti-Phishing campaigns.
• Along with those initiatives. your organization should routinely conduct user reviews of threat.