Chapter -1 Security Principals
CIA Triad
The CIA Triad is a widely used model in information security that represents the three core principles essential for ensuring the security and confidentiality of information. These principles are:
Confidentiality: Ensures that information is only accessible to those who are authorized to access it. This principle helps protect sensitive data from unauthorized access, such as through encryption or access control mechanisms.
Integrity: Ensures that the information remains accurate, consistent, and unaltered unless authorized. Integrity involves protecting data from being modified, corrupted, or deleted, ensuring that it can be trusted.
Availability: Ensures that information and systems are accessible and usable when needed by authorized users. This principle focuses on ensuring that systems are operational and data can be accessed in a timely manner, typically through backups and redundancy.
Together, these three principles form the foundation of information security practices.
Threat & Risk Management Process
Risk:
Risk refers to the potential for harm or loss to an organization's assets, systems, or data due to vulnerabilities or threats. It is the likelihood that a threat will exploit a vulnerability and cause damage, and the impact of that damage. Risk is typically assessed based on the probability of an event occurring and the potential severity of its consequences.
Risk = Likelihood × Impact
For example, the risk of a data breach might be higher if an organization does not have adequate security measures in place, and the impact could be severe if sensitive data is exposed.
Threat:
A threat is any potential cause of an incident that could harm or compromise the security of information, systems, or infrastructure. Threats can be intentional (like cyberattacks) or unintentional (like natural disasters or human error). A threat becomes a risk when it can exploit vulnerabilities in a system.
Examples of threats include hackers, malware, social engineering, natural disasters, and even employee negligence.
Risk management process
Security Controls
Security controls are measures implemented to safeguard an organization's information, systems, and assets from risks and threats. These controls can be categorized into Physical, Technical, and Administrative controls, each addressing different aspects of security.
Physical security controls are measures designed to protect the physical infrastructure, facilities, and equipment of an organization. These controls focus on preventing unauthorized access to physical spaces and protecting against physical threats such as theft, vandalism, or natural disasters.
Examples:
Access control systems: Keycards, biometric scanners, or security guards that restrict access to buildings, server rooms, or restricted areas.
Surveillance cameras: CCTV cameras to monitor and record activity in critical areas.
Locks and barriers: Physical locks, gates, fences, or safes to secure valuable assets and prevent unauthorized entry.
Environmental controls: Fire suppression systems, water leak detectors, and temperature controls to protect against environmental hazards.
Technical security controls (also called logical controls) involve the use of technology to protect systems, networks, and data from unauthorized access, misuse, or attacks. These controls focus on safeguarding the organization's digital assets through various software and hardware measures.
Examples:
Firewalls: Devices or software that monitor and filter network traffic to prevent unauthorized access and attacks.
Encryption: Protecting data by converting it into a coded format to prevent unauthorized access, both for data at rest (stored) and in transit (moving across networks).
Intrusion Detection and Prevention Systems (IDPS): Systems that detect and block suspicious or malicious network traffic and activities.
Multi-factor authentication (MFA): Requiring multiple forms of verification to ensure that only authorized users can access systems or data.
Antivirus and anti-malware software: Programs designed to detect, prevent, and remove malicious software such as viruses and trojans.
Administrative controls focus on the policies, procedures, and practices that govern the organization’s security efforts. These controls ensure that security is maintained through effective management, training, and oversight.
Examples:
Security policies and procedures: Written guidelines and protocols that define how security should be managed within the organization (e.g., password policies, incident response plans).
Employee training and awareness: Programs that educate staff about security best practices, such as identifying phishing attempts or securing sensitive information.
Risk management processes: Identifying, assessing, and mitigating risks through regular risk assessments and the implementation of appropriate countermeasures.
Incident response and recovery planning: Developing and practicing procedures to respond to security incidents (e.g., data breaches, cyberattacks).
Access control policies: Defining and enforcing rules regarding who has access to specific systems and data, ensuring that individuals can only access the resources necessary for their job.
Governance
Procedures : The detailed steps to complete a task that support departmental or organizational policies.
Policies : Put in place by organizational governance, such as executive management, to provide guidance to all activities to ensure that the organization supports industry standards and regulations.
Standards : Often used by governance teams to provide a framework to introduce policies and procedures in support of regulations.
Regulations : Commonly issued in the form of laws, usually from government (not to be confused with governance) and typically carry financial penalties for non-compliance.
Chapter Resouces :
Last updated