Scribd
Upload
20 views

001 - Cybersecurity Fundamentals Security Principles

The document discusses security principles including concepts like confidentiality, integrity and availability. It covers authentication methods, non-repudiation and privacy. It also discusses risk management processes and security controls like physical, technical and administrative controls. Finally, it discusses governance elements and standards.

Uploaded by

PPKD MTU
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
20 views

001 - Cybersecurity Fundamentals Security Principles

The document discusses security principles including concepts like confidentiality, integrity and availability. It covers authentication methods, non-repudiation and privacy. It also discusses risk management processes and security controls like physical, technical and administrative controls. Finally, it discusses governance elements and standards.

Uploaded by

PPKD MTU
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 23

Module 1 : Security Principles

Security Principles

Risk Management
Security Concepts
Process

Governance Elements
Security Controls
and Process
Security
Concepts
• The CIA Triad
• CIA Triad Deep Dive
• Authentication
• Methods of Authentication
• Non-repudiation
• Privacy
Security
Concepts :
The CIA
Triad
Security Concepts : CIA Triad Deep Dive

Confidentiality Integrity Availability


Confidentiality relates to permitting Integrity is the property of information Availability means that systems and data
authorized access to information, while at whereby it is recorded, used and are accessible at the time users need
the same time protecting information maintained in a way that ensures its them.
from improper disclosure. completeness, accuracy, internal
consistency and usefulness for a stated
purpose.
Personally Identifiable Information (PII) information or data criticality
protected health information (PHI) systems and processes for business operations
classified or sensitive information organizations
sensitivity people and their actions
Data Integrity
System Integrity (state & baseline)
This process of verifying or
proving the user’s identification is
known as authentication. Simply put,
authentication is a process to prove
the identity of the requestor.
Security
Concepts :
Authentication
There are three common methods
of authentication:
Something you Something you
Something you
have: Tokens, are: Biometrics ,
know: Passwords
memory cards, measurable
or passphrases smart cards characteristics
Security Concepts : Methods of
Authentication

• Single-factor authentication
• Multi-factor authentication
• Common best practice is to implement at least
two of the three common techniques for
authentication:
o Knowledge-based
o Token-based
o Characteristic-based
Security Concepts : Non-repudiation

Protection against an individual falsely denying Non-repudiation methodologies ensure that


having performed a particular action. people are held responsible for transactions they
conducted.
Security Concepts : Privacy

The right of an individual to control the General Data Protection Regulation (GDPR)
distribution of information about themselves.
Security Concepts : Summary
Risk
Management Asset : something in need of
Process : protection.

Risk
Management Vulnerability : a gap or weakness

Terminology in those protection efforts.

Threat : something or someone


that aims to exploit a vulnerability
to thwart protection efforts.
a recurring process of identifying different possible
risks, characterizing them and then estimating their
potential for disrupting the organization.

RISK
MANAGEMENT Identify risk to communicate it clearly.

PROCESS :
RISK Employees at all levels of the organization are
responsible for identifying risk.

IDENTIFICATION
Identify risk to protect against it.
RISK MANAGEMENT PROCESS :
RISK ASSESSMENT

• The process of identifying, estimating


and prioritizing risks to an
organization’s operations (including its
mission, functions, image and
reputation), assets, individuals, other
organizations and even the nation.
RISK MANAGEMENT PROCESS :
RISK TREATMENT

• Risk avoidance is the decision to attempt to


eliminate the risk entirely.
• Risk mitigation is taking actions to prevent or
reduce the possibility of a risk event or its
impact.
• Risk transference is the practice of passing the
risk to another party, who will accept the
financial impact of the harm resulting from a
risk being realized in exchange for payment.
• Risk acceptance is taking no action to reduce
the likelihood of a risk occurring.
RISK MANAGEMENT PROCESS :
RISK PRIORITIES

• Qualitative risk analysis


• Quantitative risk analysis
Risk Term Review
SECURITY CONTROL :
WHAT IS SECURITY CONTROL?

• Security controls pertain to the


physical, technical and
administrative mechanisms that act as
safeguards or countermeasures
prescribed for an information system
to protect the confidentiality, integrity
and availability of the system and its
information.
• The implementation of controls should
reduce risk, hopefully to an acceptable
level.
SECURITY CONTROL : PHYSICAL CONTROL
Physical controls address process-based security needs using physical hardware devices, such as badge readers,
architectural features of buildings and facilities, and specific security actions to be taken by people.

Controlling, directing or preventing the movement of people and equipment throughout a specific physical
location

Protection and control over entry onto the land surrounding the buildings, parking lots or other areas that are
within the organization’s control

Physical controls are supported by technical controls as a means of incorporating them into an overall security
system.
SECURITY CONTROL : TECHNICAL CONTROL

Security controls that Provide automated


computer systems and protection from
networks directly unauthorized access or
implement. misuse.

Support security
Facilitate detection of
requirements for
security violations
applications and data.
Directives, guidelines or advisories
aimed at the people within the
organization

SECURITY Provide frameworks, constraints and


CONTROL : standards for human behavior
ADMINISTRATIVE
CONTROL Cover the entire scope of the
organization’s activities and its
interactions
• External parties
• Stakeholders
GOVERNANCE ELEMENTS
o REGULATIONS
§ commonly issued in the form of laws, usually from
government (not to be confused with governance) and
typically carry financial penalties for noncompliance.
o STANDARD
§ provide a framework to introduce policies and procedures in
support of regulations.
o POLICIES
§ guidance in all activities to ensure that the organization
supports industry standards and regulations.
o PROCEDURES
§ detailed steps to complete a task that support departmental
or organizational policies.
GOVERNANCE
PROCESS
STANDARDS

The International Organization for Standardization (ISO) develops and publishes international standards on a variety of technical
subjects, including information systems and information security, as well as encryption standards. ISO solicits input from the
international community of experts to provide input on its standards prior to publishing.

The National Institute of Standards and Technology (NIST) is a United States government agency under the Department of
Commerce and publishes a variety of technical standards in addition to information technology and information security
standards. Many of the standards issued by NIST are requirements for U.S. government agencies and are considered
recommended standards by industries worldwide.

From Internet Engineering Task Force (IETF), there are standards in communication protocols that ensure all computers can
connect with each other across borders, even when the operators do not speak the same language.

The Institute of Electrical and Electronics Engineers (IEEE) also sets standards for telecommunications, computer engineering and
similar disciplines.

You might also like