Outline

Domain 1: Security Principles

1.1 - Understand the security concepts of information assurance

CIA Triangle

• Confidentiality

  • permitting authorized access to information while at the same time protecting it from improper disclosure.

• Integrity

  • property of information whereby it is recorded, used, and maintained in a way that ensures its completeness, accuracy, internal consistency, and usefulness for a stated purpose.

• Availability

  • systems and data are accessible at the time users need them.

• Authentication (e.g., methods of authentication, multi-factor authentication (MFA))

  • verifying or validating the user’s identification (rightful owners of the identity)

  Methods of authentication

  • Type 1: Something you know - passwords or paraphrases
  • Type 2: Something You have - tokens, memory card, smart cards
  • Type 3: Something You are - Biometrics and measurable characteristics

  Multi-factor authentication (MFA)

  • two or more instances of different authentication factors

• Non-repudiation

  • inability to deny taking an action such as creating information, approving information, or sending or receiving a message.
  • protection against an individual falsely denying having performed a particular action. It provides the capability to determine whether a given individual took a particular action, such as created information, approved information or sent or received a message.

  Example: online purchase transactions or activity logs

  • non-repudiation methods ensure that people are held responsible for transactions they conducted.

• Privacy

  • right of an individual to control the distribution of information about themselves.

  EU GDPR

  • 2016
  • Personal Privacy is human right
  • Applies to: all local and foreign organizations doing business with the EU or EU person
  • Member states enact. Some have more requirements (ex: National and state laws)

  HIPAA

  • privacy of medical information

  US State Privacy Laws

  • may enact laws pertaining to

  Personally Identifiable Information (PII)

  • information that, when combined with pieces of data, significantly narrows the possibility of association with more individual

1.2 - Understand the risk management process

• Risk management (e.g., risk priorities, risk tolerance)

  • Security professionals utilize their expertise to assess operational risk management, leverage risk data effectively, collaborate cross-functionally, and report actionable insights to relevant stakeholders.

  Asset

  • something in need of protection
  • cybersecurity context

  Vulnerability

  • gap/weakness in those protection efforts
    • Example: Tourist is distracted and not watching wallet

  Threat

  • something/someone that aims to exploit vulnerability to thwart protection efforts
    • Example: Pickpocket in tourist area

  Decision Making on Risk Priorities

  • evaluate likelihood and impact
  • tolerance
    • executive management and board of directors is responsible for this
  • applies to different sorts of risk

• Risk identification, assessment and treatment

  Risk Identification

  • How do you identify risks?
  • recurring activity
  • identify risks, characterize them, estimate potential in disrupting org
    • look at org and analyze unique situation
    • strategic, operational, and tactical plans

  Takeaways:

  • Identify risk to communicate it early
  • employees at ALL levels are responsible for identifying risk.
  • Identify risk to protect against it.

  Security professionals: assist in risk assessment at a system level (process, control, monitoring, or incident response or recovery.)

  Smaller orgs or lack risk management and mitigation plan: opportunity to fill that void

Risk mitigation: Evaluate likelihood then take appropriate action

1.3 - Understand security controls

Security controls in risk management process to mitigate risk at an acceptable level.