Security Fundamentals Quiz

Study Notes

Security Principles and Guidelines

Confidentiality: Protect sensitive information by ensuring access is restricted to authorized individuals and systems. Utilize encryption, access controls, and secure communication channels.
Integrity: Maintain data accuracy and consistency throughout its lifecycle using hashing, digital signatures, and access controls to prevent unauthorized changes.
Availability: Guarantee access to systems and data for authorized users when needed. Implement redundancy, failover mechanisms, and disaster recovery plans to minimize downtime.
Authentication: Confirm the identity of users and entities before providing access to resources. Strong methods include passwords, biometrics, multi-factor authentication (MFA), and certificates.
Authorization: Allocate access rights based on user roles and responsibilities. Employ access controls, least privilege principles, and role-based access control (RBAC) to limit unauthorized access.
Accountability: Enforce accountability through auditing, logging, and monitoring activities. Maintain records of user actions and security events for forensic investigation.
Non-repudiation: Establish proof of origin and integrity for actions through digital signatures, transaction logs, and secure timestamps, preventing parties from denying their involvement.
Least Privilege: Limit user access to the minimum necessary for task completion to reduce the risk of security incidents and unauthorized actions.
Defense in Depth: Utilize multiple layers of security controls to mitigate risks. Integrate preventive, detective, and corrective measures across different levels of the system architecture.
Security by Design: Embed security considerations in the design and development processes for systems and applications. Focus on secure coding practices, threat modeling, and early vulnerability identification.
Continuous Monitoring and Improvement: Regularly review and assess the security posture to adapt to new threats and vulnerabilities. Stay updated with best practices and refine security measures accordingly.

Information Assurance Trends

Cloud Security: As organizations shift to cloud computing, protecting data and applications in the cloud gains importance. Focus areas include cloud-native security solutions and robust identity and access management (IAM) strategies.
Example: A company can host its website using cloud services like AWS, Google Cloud Platform, or Microsoft Azure, negating the need for physical servers by uploading their website files to the provider's infrastructure.