Professional Documents
Culture Documents
Isc2 CC
Isc2 CC
Security Principles
Chapter Summary
In this chapter, we covered security principles, starting with concepts of information assurance.
We highlighted the CIA triad as the primary components of information assurance. The “C”
stands for confidentiality; we must protect the data that needs protection and prevent access
to unauthorized individuals. The “I” represents integrity; we must ensure the data has not
been altered in an unauthorized manner. The “A” symbolizes availability; we must make sure
data is accessible to authorized users when and where it is needed, and in the form and format
that is required. We also discussed the importance of privacy, authentication, non-repudiation,
and authorization.
You explored the safeguards and countermeasures prescribed for an information system to
protect the confidentiality, integrity and availability of the system and its information. By
applying risk management, we were able to assess and prioritize the risks (asset vulnerabilities
that can be exploited by threats) to an organization. An organization can decide whether to
accept the risk (ignoring the risks and continuing risky activities), avoid the risk (ceasing the
risky activity to remove the likelihood that an event will occur), mitigate the risk (taking action
to prevent or reduce the impact of an event), or transfer the risk (passing risk to a third party).
You then learned about three types of security controls: physical, technical and administrative.
They act as safeguards or countermeasures prescribed for an information system to protect the
confidentiality, integrity and availability of the system and its information. The implementation
of security controls should reduce risk, hopefully to an acceptable level. Physical controls
address process-based security needs using physical hardware devices, such as a badge
reader, architectural features of buildings and facilities, and specific security actions taken by
people. Technical controls (also called logical controls) are security controls that computer
systems and networks directly implement. Administrative controls (also known as managerial
controls) are directives, guidelines or advisories aimed at the people within the organization.
You were then introduced to organizational security roles and governance, the policies and
procedures that shape organizational management and drive decision-making. As discussed,
we typically derive procedures from policies, policies from standards, standards from
regulations. Regulations are commonly issued in the form of laws, usually from government
(not to be confused with governance) and typically carry financial penalties for noncompliance.
Standards are often used by governance teams to provide a framework to introduce
policies and procedures in support of regulations. Policies are put in place by organizational
governance, such as executive management, to provide guidance in all activities to ensure
that the organization supports industry standards and regulations. Procedures are the detailed
steps to complete a task that support departmental or organizational policies.
Finally, we covered the (ISC)² Code of Ethics, which members of the organization commit to
fully support. Bottom line, we must act legally and ethically in the field of cybersecurity.
Risk Identification:
• Identify risk to communicate it clearly.
• Employees at all levels of the organization are responsible for identifying risk.
• Identify risk to protect against it.
Risk Assessment:
• The process of identifying, estimating and prioritizing risks to an organization’s:
Ǯ Operations (including its mission, functions, image and reputation)
Ǯ Assets
Ǯ Individuals
Ǯ Other organizations
Ǯ Even the nation
• Should result in aligning (or associating) each identified risk resulting from the
operation of an information system with the goals, objectives, assets or processes
Risk Treatment:
• Accept the risk—Risk acceptance is taking no action to reduce the likelihood of a risk
occurring.
• Avoid the risk—Risk avoidance is the decision to attempt to eliminate the risk entirely.
• Reduce (mitigate) the risk—Risk mitigation is the most common type of risk
management and includes taking actions to prevent or reduce the possibility of a risk
event or its impact.
• Transfer or share the risk—Risk transference is the practice of passing the risk to
another party, who will accept the financial impact of the harm resulting from a risk
being realized in exchange for payment.
Integrity Availability
We must strive to provide information assurance, and these primary components help make
information assurance possible: confidentiality, integrity and availability.
Confidentiality: protect the data that needs protection and permit access to authorized
individuals while preventing access to unauthorized individuals.
Integrity: ensure the data has not been altered in an unauthorized manner.
Availability: ensure the data is accessible to authorized users when and where it is needed,
and in the form and format that is required.
Chapter 1: Graphics 7
Prioritizing Risk
Probability
High Probability High Probability
Low Impact High Impact
Impact
You can use this simple probability and impact model to determine the level of risk and
therefore prioritize risk. You can assign numbers to the level of probability and impact. For
example, a risk with a high probability and high impact can be represented by a 1, low
probability and high impact a 2, high probability and low impact a 3, and low probability and
low impact a 4. This would put the risks in priority order, with 1s being your first priority and 4s
being your last priority.
Chapter 1: Graphics 8
Security Controls
Physical
Controls
Security
Controls
Administrative Technical
Controls Controls
Physical controls: physical hardware devices, such as a badge reader, architectural features of
buildings and facilities that address process-based security needs.
Technical controls (also called logical controls): security controls that computer systems and
networks directly implement.
Chapter 1: Graphics 9
Formulas and Calculations
Level of Risk = Probability + Impact
Administrative Controls
Controls implemented through policy and procedures. Examples include access control processes
and requiring multiple personnel to conduct a specific operation. Administrative controls in mod-
ern environments are often enforced in conjunction with physical and/or technical controls, such as
an access-granting policy for new users that requires login and approval by the hiring manager.
Artificial Intelligence
The ability of computers and robots to simulate human intelligence and behavior.
Asset
Anything of value that is owned by an organization. Assets include both tangible items such as
information systems and physical property and intangible assets such as intellectual property.
Authentication
Access control process validating that the identity being claimed by a user or entity is known to
the system, by comparing one (single-factor or SFA) or more (multi-factor authentication or MFA)
factors of identification.
Authorization
The right or a permission that is granted to a system entity to access a system resource. NIST 800-
82 Rev.2
Availability
Ensuring timely and reliable access to and use of information by authorized users.
Baseline
A documented, lowest level of security configuration allowed by a standard or organization.
Biometric
Biological characteristics of an individual, such as a fingerprint, hand geometry, voice, or iris pat-
terns.
Confidentiality
The characteristic of data or information when it is not made available or disclosed to unautho-
rized persons or processes. NIST 800-66
Criticality
A measure of the degree to which an organization depends on the information or information sys-
tem for the success of a mission or of a business function. NIST SP 800-60 Vol. 1, Rev. 1
Data Integrity
The property that data has not been altered in an unauthorized manner. Data integrity covers data
in storage, during processing and while in transit. Source: NIST SP 800-27 Rev A
Encryption
The process and act of converting the message from its plaintext to ciphertext. Sometimes it is
also referred to as enciphering. The two terms are sometimes used interchangeably in literature
and have similar meanings.
Governance
The process of how an organization is managed; usually includes all aspects of how decisions are
made for that organization, such as policies, roles and procedures the organization uses to make
those decisions.
Integrity
The property of information whereby it is recorded, used and maintained in a way that ensures its
completeness, accuracy, internal consistency and usefulness for a stated purpose.
Likelihood
The probability that a potential vulnerability may be exercised within the construct of the associat-
ed threat environment.
Likelihood of Occurrence
A weighted factor based on a subjective analysis of the probability that a given threat is capable of
exploiting a given vulnerability or set of vulnerabilities.
Non-repudiation
The inability to deny taking an action such as creating information, approving information and
sending or receiving a message.
Physical Controls
Controls implemented through a tangible mechanism. Examples include walls, fences, guards,
locks, etc. In modern organizations, many physical control systems are linked to technical/logical
systems, such as badge readers connected to door locks.
Privacy
The right of an individual to control the distribution of information about themselves.
Probability
The chances, or likelihood, that a given threat is capable of exploiting a given vulnerability or a set
of vulnerabilities. Source: NIST SP 800-30 Rev. 1
Risk
A possible event which can have a negative impact upon the organization.
Risk Acceptance
Determining that the potential benefits of a business function outweigh the possible risk impact/
likelihood and performing that business function with no other action.
Risk Assessment
The process of identifying and analyzing risks to organizational operations (including mission, func-
tions, image, or reputation), organizational assets, individuals and other organizations. The analysis
performed as part of risk management which incorporates threat and vulnerability analyses and
considers mitigations provided by security controls planned or in place.
Risk Avoidance
Determining that the impact and/or likelihood of a specific risk is too great to be offset by the po-
tential benefits and not performing a certain business function because of that determination.
Risk Management
The process of identifying, evaluating and controlling threats, including all the phases of risk con-
text (or frame), risk assessment, risk treatment and risk monitoring.
Risk Mitigation
Putting security controls in place to reduce the possible impact and/or likelihood of a specific risk.
Risk Transference
Paying an external party to accept the financial impact of a given risk.
Risk Treatment
The determination of the best way to address an identified risk.
Security Controls
The management, operational and technical controls (i.e., safeguards or countermeasures) pre-
scribed for an information system to protect the confidentiality, integrity and availability of the
system and its information. Source: FIPS PUB 199
Sensitivity
A measure of the importance assigned to information by its owner, for the purpose of denoting its
need for protection. Source: NIST SP 800-60 Vol 1 Rev 1
Single-Factor Authentication
Use of just one of the three available factors (something you know, something you have, some-
thing you are) to carry out the authentication process being requested.
State
The condition an entity is in at a point in time.
System Integrity
The quality that a system has when it performs its intended function in an unimpaired manner, free
from unauthorized manipulation of the system, whether intentional or accidental. Source: NIST SP
800-27 Rev. A
Technical Controls
Security controls (i.e., safeguards or countermeasures) for an information system that are primarily
implemented and executed by the information system through mechanisms contained in the hard-
ware, software or firmware components of the system.
Threat Actor
An individual or a group that attempts to exploit vulnerabilities to cause or force a threat to occur.
Threat Vector
The means by which a threat actor carries out their objectives.
Token
A physical object a user possesses and controls that is used to authenticate the user’s identity.
NISTIR 7711
Vulnerability
Weakness in an information system, system security procedures, internal controls or implementa-
tion that could be exploited by a threat source. Source: NIST SP 800-30 Rev 1
Second, the Business Continuity plan is designed to keep the organization operating through
the crisis. Components of the Business Continuity plan include details about how and when
to enact the plan and notification systems and call trees for alerting the team members and
organizational associates that the plan has been enacted. In addition, it includes contact
numbers for contacting critical third-party partners, external emergency providers, vendors
and customers. The plan provides the team with immediate response procedures and
checklists and guidance for management.
Finally, if both the Incident Response and Business Continuity plans fail, the Disaster Recovery
plan is activated to return operations to normal as quickly as possible. The Disaster Recovery
plan may include the following components: executive summary providing a high-level
overview of the plan, department-specific plans, technical guides for IT personnel responsible
for implementing and maintaining critical backup systems, full copies of the plan for critical
disaster recovery team members, and checklists for certain individuals.
Detection Containment,
and Eradication Post-incident
Preparation
Analysis and Recovery Activity
Knowing the components of and their relationship to each other will help you build and follow
an Incident Response Plan.
Chapter 2: Graphics 7
Chapter Terms and Definitions
Adverse Events
Events with a negative consequence, such as system crashes, network packet floods, unauthorized
use of system privileges, defacement of a web page or execution of malicious code that destroys
data.
Breach
The loss of control, compromise, unauthorized disclosure, unauthorized acquisition or any similar
occurrence where: a person other than an authorized user accesses or potentially accesses person-
ally identifiable information; or an authorized user accesses personally identifiable information for
other than an authorized purpose. Source: NIST SP 800-53 Rev. 5
Event
Any observable occurrence in a network or system. Source: NIST SP 800-61 Rev 2
Incident
An event that actually or potentially jeopardizes the confidentiality, integrity or availability of an
information system or the information the system processes, stores or transmits.
Incident Handling
The mitigation of violations of security policies and recommended practices. Source: NIST SP 800-
61 Rev 2
Intrusion
A security event, or combination of security events, that constitutes a security incident in which an
intruder gains, or attempts to gain, access to a system or system resource without authorization.
Source: IETF RFC 4949 Ver 2
Vulnerability
Weakness in an information system, system security procedures, internal controls or implementa-
tion that could be exploited or triggered by a threat source. Source: NIST SP 800-128.
Zero Day
A previously unknown system vulnerability with the potential of exploitation without risk of detec-
tion or prevention because it does not, in general, fit recognized patterns, signatures or methods.
We also discussed defense in depth (an information security strategy integrating people,
technology, and operations capabilities to establish variable barriers across multiple layers
and missions of the organization) and how it applies to the types of access control (physical,
logical/technical, and administrative) that every information security professional should be
familiar with. At the same time, we stressed the importance of the Principle of Least Privilege
(users should only have the minimum access necessary to accomplish their job).
We then discussed Privileged Access Management and how it relates to risk and the CIA
Triad: it reduces risk by allowing admin privileges to be used only when needed, provides
confidentiality by limiting the need for administrative access that is used during routine
business, ensures integrity by only allowing authorized administrative access during approved
activities, and confirms availability by providing administrative access when needed. We also
differentiated between a Regular User Account and a Privileged User Account.
We further discussed segregation of duties, two-person integrity, and how users are
provisioned, from being hired to being terminated. We then explored physical and logical
access controls and how they are combined to strengthen the overall security of an
organization. Physical access controls include security guards, fences, motion detectors,
locked doors/gates, sealed windows, lights, cable protection, laptop locks, badges, swipe
cards, guard dogs, cameras, mantraps/turnstiles and alarms. Logical access controls (also
called technical controls) can be configuration settings or parameters stored as data, managed
through a software graphical user interface (GUI), or they can be hardware settings done with
switches, jumper plugs or other means.
We concluded the chapter discussing three logical access controls: DAC, MAC, and RBAC.
Discretionary access control (DAC) is a specific type of access control policy that is controlled
by the owner of the resource and enforced at the subject level over objects in an information
system. A mandatory access control (MAC) policy is one that is uniformly enforced across all
subjects and objects within the boundary of an information system. Role-based access control
(RBAC), as the name suggests, sets up user permissions based on roles.
Defense in Depth
• An information security strategy that integrates people, technology and operations
capabilities to establish variable barriers across multiple layers and missions of the
organization.
• Applies multiple countermeasures in a layered fashion to fulfill security objectives.
• Should be implemented to prevent or deter a cyberattack, but it cannot guarantee
that an attack will not occur.
Log terminology:
• Log anomaly
• Log consolidation
• Log retention
Assets
Chapter 3: Graphics 7
Chapter Terms and Definitions
Audit
Independent review and examination of records and activities to assess the adequacy of system
controls, to ensure compliance with established policies and operational procedures. NIST SP
1800-15B
Defense in Depth
Information security strategy integrating people, technology, and operations capabilities to es-
tablish variable barriers across multiple layers and missions of the organization. Source: NIST SP
800-53 Rev 4
Encrypt
To protect private information by putting it into a form that can only be read by people who have
permission to do so.
Firewalls
Devices that enforce administrative security policies by filtering incoming traffic based on a set of
rules.
Insider Threat
An entity with authorized access that has the potential to harm an information system through
destruction, disclosure, modification of data, and/or denial of service. NIST SP 800-32
iOS
An operating system manufactured by Apple Inc. Used for mobile devices.
Layered Defense
The use of multiple controls arranged in series to provide several consecutive controls to protect
an asset; also called defense in depth.
Log Anomaly
A system irregularity that is identified when studying log entries which could represent events of
interest for further surveillance.
Logging
Collecting and storing user activities in a log, which is a record of the events occurring within an
organization’s systems and networks. NIST SP 1800-25B.
Mantrap
An entrance to a building or an area that requires people to pass through two doors with only one
door opened at a time.
Object
Passive information system-related entity (e.g., devices, files, records, tables, processes, programs,
domains) containing or receiving information. Access to an object (by a subject) implies access to
the information it contains. See subject. Source: NIST SP 800-53 Rev 4
Ransomware
A type of malicious software that locks the computer screen or files, thus preventing or limiting a
user from accessing their system and data until money is paid.
Rule
An instruction developed to allow or deny access to a system by comparing the validated identity
of the subject to an access control list.
Segregation of Duties
The practice of ensuring that an organizational process cannot be completed by a single person;
forces collusion as a means to reduce insider threats. Also commonly known as Separation of Du-
ties.
Subject
Generally an individual, process or device causing information to flow among objects or change to
the system state. Source: NIST SP800-53 R4
Technical Controls
The security controls (i.e., safeguards or countermeasures) for an information system that are
primarily implemented and executed by the information system through mechanisms contained in
the hardware, software or firmware components of the system.
Turnstile
A one-way spinning door or barrier that allows only one person at a time to enter a building or
pass through an area.
Unix
An operating system used in software development.
User Provisioning
The process of creating, maintaining and deactivating user identities on a system.
The two models discussed in this chapter are OSI and TCP/IP. The OSI model has seven layers
and the TCP/IP four. They both take the 1s and 0s from the physical or network interface layer,
where the cables or Wi-Fi connect, to the Application Layer, where users interact with the
data. The data traverses the network as packets, with headers or footers being added and
removed accordingly as they get passed layer to layer. This helps route the data and ensures
packets are not lost and remain together. IPv4 is slowly being phased out by IPv6 to improve
security, improve quality of service and support more devices.
As mentioned, Wi-Fi has replaced many of our wired networks, and with its ease of use, it also
brings security issues. Securing Wi-Fi, e.g., using WPA2, is very important.
We then learned about some of the attacks on a network, e.g., DoS/DDoS attacks, fragment
attacks, oversized packet attacks, spoofing attacks, and man-in-the middle attacks. We also
discussed the ports and protocols that connect the network and services that are used on
networks, from physical ports, e.g., LAN port, that connect the wires, to logical ports, e.g., 80
or 443, that connect the protocols/services.
We then examined some possible threats to a network, including spoofing, DoS/DDoS, virus,
worm, Trojan, on-path (man-in-the-middle) attack, and side-channel attack. The chapter went
on to discuss how to identify threats, e.g., using IDS/NIDS/HIDS or SIEM, and prevent threats,
e.g., using antivirus, scans, firewalls, or IPS/NIPS/HIPS. We discussed on-premises data centers
and their requirements, e.g., power, HVAC, fire suppression, redundancy and MOU/MOA. We
reviewed the cloud and its characteristics, to include service models: SaaS, IaaS and PaaS; and
deployment models: public, private, community and hybrid. The importance of an MSP and
SLA were also discussed.
Network Devices:
• Hubs
• Switches
• Routers
• Firewalls
• Servers
• Printers
• Fax Machines
• Gateways
• Repeaters
• Bridges
• Modems
• Access Points
• Endpoints (e.g., desktop computer, laptop, tablet, cellphone, VOIP, or any other end-
user device)
Network Models:
• OSI and TCP/IP
Secure Alternative
Insecure Port Protocol Protocol
Port
Secure File Transfer
21 - FTP File Transfer Protocol 22* - SFTP
Protocol
23 – Telnet Telnet 22* - SSH Secure Shell
Simple Mail Transfer
25 – SMTP 587 – SMTP SMTP with TLS
Protocol
Network Time
37 – Time Time Protocol 123 – NTP
Protocol
53 – DNS Domain Name Service 853 - DoT DNS over TLS (DoT)
HyperText Transfer HyperText Transfer
80 – HTTP 443 – HTTPS
Protocol Protocol (SSL/TLS)
Internet Message
143 - IMAP 993 – IMAP IMAP for SSL/TLS
Access Protocol
Simple Network
161/162 - SNMP 161/162 - SNMP SNMPv3
Management Protocol
445 – SMB Server Message Block 2049 - NFS Network File System
Lightweight Directory
Lightweight Directory
389 – LDAP 636 - LDAPS Access Protocol
Access Protocol
Secure
7 Application DATA
6 Presentation Header
DATA
5 Session DATA
4 Transport DATA
3 Network DATA
2 Data Link DATA Footer
1 Physical DATA
Chapter 4: Graphics 9
Transmission Control Protocol/Internet Protocol (TCP/IP)
Model
Application
Layer FTP Telnet SNMP LPD
Presentation Application
Layer Layer
Transport Transport
TCP UDP
Layer Layer
Data Link
Layer Network
Fast Token
Interface Ethernet FDDI
Ethernet Ring
Physical Layer
Layer
Chapter 4: Graphics 10
Chapter Terms and Definitions
Application programming interface (API)
A set of routines, standards, protocols, and tools for building software applications to access a
web-based software application or web tool.
Bit
The most essential representation of data (zero or one) at Layer 1 of the Open Systems Intercon-
nection (OSI) model.
Broadcast
Broadcast transmission is a one-to-many (one-to-everyone) form of sending internet traffic.
Byte
The byte is a unit of digital information that most commonly consists of eight bits.
Cloud computing
A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of
configurable computing resources (e.g., networks, servers, storage, applications, and services)
that can be rapidly provisioned and released with minimal management effort or service provider
interaction. NIST 800-145
Community cloud
A system in which the cloud infrastructure is provisioned for exclusive use by a specific community
of consumers from organizations that have shared concerns (e.g., mission, security requirements,
policy and compliance considerations). It may be owned, managed and operated by one or more
of the organizations in the community, a third party or some combination of them, and it may exist
on or off premises. NIST 800-145
De-encapsulation
The opposite process of encapsulation, in which bundles of data are unpacked or revealed.
Denial-of-Service (DoS)
The prevention of authorized access to resources or the delaying of time-critical operations.
(Time-critical may be milliseconds or it may be hours, depending upon the service provided.)
Source: NIST SP 800-27 Rev A
Encapsulation
Enforcement of data hiding and code hiding during all phases of software development and op-
erational use. Bundling together data and methods is the process of encapsulation; its opposite
process may be called unpacking, revealing, or using other terms. Also used to refer to taking any
set of data and packaging it or hiding it in another data structure, as is common in network proto-
cols and encryption.
Encryption
The process and act of converting the message from its plaintext to ciphertext. Sometimes it is
also referred to as enciphering. The two terms are sometimes used interchangeably in literature
and have similar meanings.
Fragment attack
In a fragment attack, an attacker fragments traffic in such a way that a system is unable to put data
packets back together.
Hardware
The physical parts of a computer and related devices.
Hybrid cloud
A combination of public cloud storage and private cloud storage where some critical data resides
in the enterprise’s private cloud while other data is stored and accessible from a public cloud stor-
age provider.
Man-in-the-Middle
An attack where the adversary positions himself in between the user and the system so that he can
intercept and alter data traveling between them. Source: NISTIR 7711
Microsegmentation
Part of a zero-trust strategy that breaks LANs into very small, highly localized zones using firewalls
or similar technologies. At the limit, this places firewall at every connection point.
Packet
Representation of data at Layer 3 of the Open Systems Interconnection (OSI) model.
Payload
The primary action of a malicious code attack.
Protocols
A set of rules (formats and procedures) to implement and control some type of association (that is,
communication) between systems. NIST SP 800-82 Rev. 2
Public cloud
The cloud infrastructure is provisioned for open use by the general public. It may be owned, man-
aged, and operated by a business, academic, or government organization, or some combination
of them. It exists on the premises of the cloud provider. NIST SP 800-145
Software
Computer programs and associated data that may be dynamically written or modified during exe-
cution. NIST SP 80--37 Rev. 2
Spoofing
Faking the sending address of a transmission to gain illegal entry into a secure system. CNSSI
4009-2015
VLAN
A virtual local area network (VLAN) is a logical group of workstations, servers, and network devices
that appear to be on the same LAN despite their geographical distribution.
VPN
A virtual private network (VPN), built on top of existing networks, that can provide a secure com-
munications mechanism for transmission between networks.
WLAN
A wireless area network (WLAN) is a group of computers and devices that are located in the same
vicinity, forming a network based on radio transmissions rather than wired connections. A Wi-Fi
network is a type of WLAN.
Zenmap
The graphical user interface (GUI) for the Nmap Security Scanner, an open-source application that
scans networks to determine everything that is connected as well as other information.
Zero Trust
Removing the design belief that the network has any trusted space. Security is managed at each
possible level, representing the most granular asset. Microsegmentation of workloads is a tool of
the model.
A best practice for securing data is encrypting the data. We explored the process of
encrypting data in plaintext with a key and algorithm to create ciphertext then using either
the same key (symmetric) or a different key (asymmetric) and same algorithm to decrypt the
ciphertext to convert it back to plaintext. Then hashing was methodically described; hashing
takes an input set of data (of almost arbitrary size) and returns a fixed-length result called the
hash value.
System hardening is the process of applying secure configurations (to reduce the attack
surface) and locking down various hardware, communications systems and software, including
operating system, web server, application server, application, etc. We also discussed
configuration management, a process and discipline used to ensure that the only changes
made to a system are those that have been authorized and validated. Configuration
management consists of identification, baseline, change control, and verification and audit.
During configuration management, one must conduct inventory, baselines, updates, and
patches.
The following best practice security policies were examined: data handling (appropriate use of
data), password (appropriate use of passwords), acceptable use (appropriate use of the assets,
devices, and data), bring your own device (appropriate use of personal devices), privacy
(appropriate protection of one’s privacy), and change management (appropriate transition
from current state to a future state). Change management practices address a common set of
core activities: documentation, approval, and rollback. It starts with a request for change (RFC)
and moves through various development and test stages until the change is released to the
end users.
We ended the chapter by discussing the importance of security awareness training and how
it reduces the internal threat to an organization. By breaking down the levels of security
awareness training into education, training, and awareness, we identified that the training
can be tailored to the security topic(s), organization, position and/or individual. We also
emphasized the importance of password protection.
CREATE
Y
O
ST
TR
OR
DES
E
ARC
E
US
HI
VE
SHARE
Chapter 5: Graphics 9
Use of Symmetric Algorithms
Sender Receiver
Out-of-Band
Key Distribution
Chapter 5: Graphics 10
Configuration Management
Configuration
Management
Verification
Change
Identification Baseline &
Control
Audit
Chapter 5: Graphics 11
Change Management Components
Change Management Components
Rollback 3 2 Approval
Chapter 5: Graphics 12
Formulas and Calculations
Cryptographic Hash Function
hashing algorithm
Asymmetric Encryption
An algorithm that uses one key to encrypt and a different key to decrypt the input plaintext.
Checksum
A digit representing the sum of the correct digits in a piece of stored or transmitted digital data,
against which later comparisons can be made to detect errors in the data.
Ciphertext
The altered form of a plaintext message so it is unreadable for anyone except the intended recipi-
ents. In other words, it has been turned into a secret.
Classification
Classification identifies the degree of harm to the organization, its stakeholders or others that
might result if an information asset is divulged to an unauthorized person, process or organization.
In short, classification is focused first and foremost on maintaining the confidentiality of the data,
based on the data sensitivity.
Configuration management
A process and discipline used to ensure that the only changes made to a system are those that
have been authorized and validated
Cryptanalyst
One who performs cryptanalysis which is the study of mathematical techniques for attempting to
defeat cryptographic techniques and/or information systems security. This includes the process of
looking for errors or weaknesses in the implementation of an algorithm or of the algorithm itself.
Cryptography
The study or applications of methods to secure or protect the meaning and content of messages,
files, or other information, usually by disguise, obscuration, or other transformations of that con-
tent and meaning.
Degaussing
A technique of erasing data on disk or tape (including video tapes) that, when performed proper-
ly, ensures that there is insufficient magnetic remanence to reconstruct data.
Digital Signature
The result of a cryptographic transformation of data which, when properly implemented, provides
the services of origin authentication, data integrity, and signer non-repudiation. NIST SP 800-12
Rev. 1
Egress Monitoring
Monitoring of outgoing network traffic.
Encryption
The process and act of converting the message from its plaintext to ciphertext. Sometimes it is
also referred to as enciphering. The two terms are sometimes used interchangeably in literature
and have similar meanings.
Encryption System
The total set of algorithms, processes, hardware, software, and procedures that taken together
provide an encryption and decryption capability.
Hardening
A reference to the process of applying secure configurations (to reduce the attack surface) and
locking down various hardware, communications systems, and software, including operating sys-
tem, web server, application server, application, etc. Hardening is normally performed based on
industry guidelines and benchmarks, such as those provided by the Center for Internet Security
(CIS).
Hash Function
An algorithm that computes a numerical value (called the hash value) on a data file or electronic
message that is used to represent that file or message and depends on the entire contents of the
file or message. A hash function can be considered to be a fingerprint of the file or message. NIST
SP 800-152
Ingress Monitoring
Monitoring of incoming network traffic.
Message Digest
A digital signature that uniquely identifies data and has the property such that changing a single
bit in the data will cause a completely different message digest to be generated. NISTIR-8011
Vol.3
Operating System
The software “master control application” that runs the computer. It is the first program loaded
when the computer is turned on, and its main component, the kernel, resides in memory at all
times. The operating system sets the standards for all application programs (such as the Web serv-
er) that run in the computer. The applications communicate with the operating system for most
user interface and file management operations. NIST SP 800-44 Version 2
Patch
A software component that, when installed, directly modifies files or device settings related to a
different software component without changing the version number or release details for the relat-
ed software component. Source: ISO/IEC 19770-2
Patch Management
The systematic notification, identification, deployment, installation and verification of operating
system and application software code revisions. These revisions are known as patches, hot fixes,
and service packs. Source: CNSSI 4009
Plaintext
A message or data in its natural format and in readable form; extremely vulnerable from a confi-
dentiality perspective.
Records
Records Retention
A practice based on the records life cycle, according to which records are retained as long as nec-
essary, and then are destroyed after the appropriate time interval has elapsed.
Remanence
Residual information remaining on storage media after clearing. NIST SP 800-88 Rev. 1
Security Governance
The entirety of the policies, roles, and processes the organization uses to make security decisions
in an organization.
Social engineering
Tactics to infiltrate systems via email, phone, text, or social media, often impersonating a person
or agency in authority or offering a gift. A low-tech method would be simply following someone
into a secure building.
Symmetric encryption
An algorithm that uses the same key in both the encryption and the decryption processes.
Web Server
A computer that provides World Wide Web (WWW) services on the Internet. It includes the hard-
ware, operating system, Web server software, and Web site content (Web pages). If the Web
server is used internally and not by the public, it may be known as an “intranet server.” NIST SP
800-44 Version 2
Whaling Attack
Phishing attacks that attempt to trick highly placed officials or private individuals with sizable as-
sets into authorizing large fund wire transfers to previously unknown entities.