Understanding Security Principles

Understanding Security

• Security means being free from danger and the goal of security is safety.
• It involves measures taken to ensure safety, which makes it the process of security.
• As security increases, convenience often decreases.

Principles of Security

• There are three types of security protections: CIA, which stands for Confidentiality, Integrity, and Availability.
  • Confidentiality ensures information is available only to authorized individuals.
  • Integrity guarantees information accuracy and completeness.
  • Availability ensures information is accessible to authorized users.
• Security involves controlling access to information.
  • Authentication confirms user credentials.
  • Authorization grants permission for specific actions.
  • Accounting creates a record of network access, resource usage, and disconnection times.
• Security controls are safeguards within an enterprise protecting the CIA triad, including Deterrent, Preventive, Detective, Compensating Corrective, and Directive controls.
  • Deterrent controls can include measures such as a security camera
  • Preventive controls can include stronger passwords
  • Detective controls can include alarm systems
  • Compensating controls can include multi factor authentication
  • Corrective controls can include things like backups
  • Directive controls can include policies

Cybersecurity versus Information Security

• Information security protects "processed data" that is essential in an enterprise environment.
• Cybersecurity involves practices, processes and technologies that protect devices, networks, and programs which process and store data electronically

Defining Information Security

• Information Security includes all policies and procedures required to keep data secure: whether transmitted, processed, stored, people or products

Knowledge Check Activity 1-1

• Confidentiality ensures only authorized parties can view protected information.

Threat Actors and Motivations

• A threat actor, also known as an attacker, is responsible for attacks.
• Financial crime targets individuals, enterprises, and governments.
• Categories of threat actors:
  • Unskilled attackers
  • Shadow IT
  • Organized crime
  • Insiders
  • Hacktivists
  • Nation-state actors
  • Competitors
  • Brokers
  • Cyberterrorists

Unskilled Attackers

• Unskilled attackers lack technical knowledge but want to perform attacks.
• They use freely available or low-cost, easy-to-use tools for attacks.
• Their motivation is usually data exfiltration or service disruption.

Shadow IT

• Shadow IT is bypassing corporate approval for technology purchases
• Employee motivations are often ethical but can weaken security.

Organized Crime

• A close-knit tightly controlled group set up to engage in illegal activities
• Recently organized crime moved into cyberattacks.
• Cyberattacks are considered less risky and more rewarding than traditional crime
• Motivation is generally financial gain

Insider Threats

• Insiders can be employees, contractors, and business partners within a company.
• Motivation could include revenge or blackmail.
• Attacks are hard to recognize.

Hacktivists

• Groups or individuals strongly motivated by ideology are called hacktivists.
• Their attacks often involve website intrusion and content changes for political statements.
• Some of their attacks are retaliatory, such as disabling a bank's website, if the bank does not support groups that the hacktivists support.
• Motivation is to cause disruption/chaos.

Nation-State Actors

• Governments are increasingly using state-sponsored attackers for cyberattacks against foes.
• Nation-state actors are often involved in multiyear intrusion campaigns targeting highly sensitive economic, proprietary, or national security information.
• A new class of attacks uses advanced persistent threat-APT to extract data silently for extended periods of time.

Other Threat Actors

• Competitors will launch attacks against opponent systems and attempt to steal classified information.
• Brokers will sell their knowledge of a weakness to other attackers or governments.
• Cyberterrorists attack a nation's network of computer infrastructure, with the intent of disruption and panic amongst citizens.

Knowledge Check Activity 1-2

• The motivation of an employee engaging in shadow IT is considered ethical but weakens security.

Threat Vectors and Attack Surfaces

• An attack surface, or threat vector, is a digital platform targeted by threat actors.
• Attack surfaces are found in all technology settings.
• The primary targets of threat actors still are things like Login pages of online banking sites.
• Common communication tools like Email, texts, instant messages, and voice calls, are common communication tools are message based such as phishing
• A supply chain is a network that moves a product from creation to the end user
• Each link is a potential threat vector and it is possible that malware can be injected into the product during its manufacturing, storage, and distribution, which is called supply chain infection.
• Software supply chains have recently been the target of attackers due to the fact that open source code allows threat actors to add malicious code.

Categories of Vulnerabilities

• A vulnerability means being open to attack or being harmed.
• Cybersecurity vulnerabilities can be categorized into software, hardware, misconfigurations,and zero-day.
• Software vulnerabilities are predominantely within software, with OS software being the chief culprit.
  • Can come in the form of a malicious update
• Hardware vulnerabilities can include the difficulty patching firmware, legacy platforms, and end-of-life hardware
• Misconfigurations settings are often not properly deployed causing misconfigurations that result in vulnerabilities.
• Zero-day vulnerabilities can be exploited before anyone knows they exist and do not give a warning.

Impacts of Attacks

• A successful attack results in several negative impacts, including data impact and overall affects.
• Overall affects include inaccessibility of systems aka availability loss, which results in lost productivity, aka financial loss.
• Attacks may also affect the public perception of the enterprise, effecting its reputation.
• Types of attacks include:
  • Data Loss: The destruction of data so that it cannot be recovered
  • Data exfiltration: Stealing data to distribute it to other parties
  • Data breach: Stealing data to disclose it in an unauthorized fashion
  • Identity theft: Taking personally identifiable information to impersonate someone

Information Security Resources

• These are resources to defend from any potential cyber attacks. They include:
  • Frameworks
  • Regulations
  • Legislation
  • Standards
  • Benchmarks/secure configuration guides
  • Information sources

Frameworks

• An information security framework documents processes to define policies and procedures for implementing and managing security controls in an enterprise.
• The National Institute of Standards and Technology (NIST) frameworks have three parts:
  • Framework Core, which is a set of activities and outcomes related to cyber security.
  • Implementation tiers levels of security maturity
  • Profiles which outline customized approaches based on specific needs.

Regulations

• Adhering to regulations is regulatory compliance.
• Most organizations must follow multiple regulations from different regulatory bodies like broadly applicable, industry specific, U.S. state regulation, and international regulations.

Legislation

• Governing bodies can enact legislation or laws to provide information security resources which would include
  • National Laws
  • Territorial Laws
  • State Laws

Standards

• A standard is a document approved through concensus for a recognized standardization body.
• Standards provide frameworks, rules, guidelines, or characteristics for products and production methods.
• The Payment Card Industry Data Security Standard (PCI DSS) is one information security compliance standard.

Benchmarks/Secure Configuration Guides

• Hardware manufacturers and software developers distribute benchmarks and secure configuration guides
• These serve as guidelines for configuring a device or software for resilience against attacks.
• These guides are usually platform-/vendor-specific and apply to specific products.

Information Sources

• Requests for comments (RFCs) are like "white papers" authored by technology bodies with experts who employ specialist engineers and scientists.
• Data feeds are continually maintained databases compiling the latest cybersecurity incidents.
• Common cybersecurity data feeds, include vulnerability feeds that provide current information on vulnerabilities.
• The adversary tactics, techniques, and procedures (TTP) is a database of how threat actors manage attacks.