MODULE 1
SECURITY FUNDAMENTALS
SUBTOPIC 1
What Is Information Security?
Information Security is the state of being protected against the unauthorized use of information,
especially electronic data, or the measures taken to achieve this.
What to Protect
Data is the facts and statistics collected together for reference or analysis.
Goals of Security
Prevention
Detection
Recovery
A fundamental understanding of the standard concepts of security is essential before people can start
securing their environment.
Risk
A risk is generally defined as the probability that an event will occur.
Threats
A threat is a possible danger that might exploit a vulnerability to breach security and therefore cause
possible harm.
Vulnerability
A vulnerability is a weakness which can be exploited by a threat actor, such as an attacker, to perform
unauthorized actions within a computer system.
Intrusion
Intrusions often involves stealing valuable resources and almost always jeopardize the security of the
systems and/or their data.
Attacks
Attack is to set upon in a forceful, violent, hostile, or aggressive way, with or without a weapon
Security Controls
Controls are the countermeasures that you need to put in place to avoid, mitigate, or counteract security
risks due to threats or attacks.
Security Management Process
Identification is the action or process of identifying someone or something or the fact of being identified.
CIA Triad
The CIA Triad is a well-known, venerable model for the development of security policies used in identifying
problem areas, along with necessary solutions in the arena of information security.
Confidentiality
Confidentiality is a concept we deal with frequently in real life. We expect our doctor to keep our medical
records confidential.
There are several technologies that support confidentiality in an enterprise security implementation.
These include the following:
• Strong encryption
• Strong authentication
• Stringent access controls
Integrity
We define integrity in the information security context as the consistency, accuracy, and validity of data
or information.
Availability
Availability is the third core security principle, and it is defined as a characteristic of a resource being
accessible to a user, application, or computer system when required
SUBTOPIC 2
Identification
Identification is defined as the act of determining who someone or what something is.
Authentication
Authentication is the process of verifying the identity of a person or device.
Authentication Factors
• Something you are Fingerprints, handprints, or retinal patterns
• Something you have Key or ID card
• Something you know Password or PIN
• Somewhere you are or are not IP address or GPS
• Something you do Keystroke patterns
Authorization
Authorization is the process of giving individuals access to system objects based on their identity.
Non-repudiation
Non-repudiation is the assurance that someone cannot deny the validity of something. Nonrepudiation
prevents one party from denying actions they carry out.
Access Control
Determining and assigning privileges to resources, objects, or data
Access Control Models
Mandatory Access Control (MAC)
Discretionary Access Control (DAC)
Role-Based Access Control (RBAC)
Rule-Based Access Control
Accounting and Auditing
The process of tracking and recording system activities and resource access.
Common Security Practices
Implicit deny
Least privilege
Separation of duties
Job rotation
Mandatory vacation
Time of day restrictions
Privilege management
Implicit Deny
An implicit deny only denies a permission until the user or group can perform the permission.
Least Privilege
Least Privilege is a security discipline that requires that a user, system, or application be given no more
privilege than necessary to perform its function or job.
Separation of Duties
Separation of duties is a principle that prevents any single person or entity from being able to have full
access or complete all the functions of a critical or sensitive process.
Job Rotation
Job rotation is a concept that has employees rotate through different jobs to learn the procedures and
processes in each.
Mandatory Vacation
Mandatory vacations policies require employees to take time away from their job.
Time of Day Restrictions
Time of day restrictions limit when users can access specific systems based on the time of day or week.
Security Tokens
A security token (or sometimes a hardware token, hard token, authentication token, USB token,
cryptographic token, or key fob) is a physical device that an authorized user of computer services is given
to ease authentication.
Biometrics
Fingerprint scanner
Retinal scanner
Hand geometry scanner
Voice-recognition software
Facial-recognition software
Biometrics is an authentication method that identifies and recognizes people based on voice recognition
or physical traits such as a fingerprint, face recognition, iris recognition, and retina scan.
Keystroke Authentication
Keystroke dynamics has been used to strengthen password-based user authentication systems by
considering the typing characteristics of legitimate users.
Multifactor Authentication
When two or more authentication methods are used to authenticate someone, a multifactor
authentication system is being implemented.
Cryptography
Cryptography is a method of protecting information and communications using codes so that only those
for whom the information is intended can read and process it.
Encryption and Decryption
Encryption is a process which transforms the original information into an unrecognizable form.
Decryption is a process of converting encoded/encrypted data in a form that is readable and understood
by a human or a computer.
Ciphers
Cipher is a system of writing that prevents most people from understanding the message
Cipher Types
Stream ciphers create an arbitrarily long stream of key material, which is combined with plain text bit-by-
bit or character-by-character.
Block cipher takes a block of plain text and a key, and outputs a block of ciphertext of the same size.
Steganography
The art and science of hiding information by embedding messages within other, seemingly harmless
messages.
Types of Encryption
Encryption algorithms can be divided into three classes:
Symmetric
Asymmetric, and
Hash function.
Symmetric and Asymmetric encryption can encrypt and decrypt data.
A Hash function can only encrypt data; that data cannot be decrypted
Hashing Encryption
Hashing is one way to enable security during the process of message transmission when the message is
intended for a recipient only.
Hashing Encryption Algorithms
MD5 – (Message Digest)
SHA – (Secure Hash Algorithms)
NTLM versions 1 and 2 – New Technology LAN Manager
RIPEMD - RACE Integrity Primitives Evaluation Message Digest
HMAC - Hash-based Message Authentication Code
Key
An encryption key is a random string of bits created explicitly for scrambling and unscrambling data.
Symmetric Encryption
Symmetric encryption uses a single key to encrypt and decrypt data. Therefore, it is also referred to as
secret-key, single-key, shared-key, and private-key encryption.
Symmetric Encryption Algorithms
DES - Data Encryption Standard
3DES – Triple Data Encryption Standard
AES - Advanced Encryption Standard
Blowfish
Twofish
RC 4, 5, 6
Asymmetric Encryption
Asymmetric encryption, also known as public key cryptography, uses two mathematically related keys.
Asymmetric Encryption Techniques
RSA - Rivest–Shamir–Adleman
DH - Diffie–Hellman key exchange.
ECC - Elliptic curve cryptography
DHE - Diffie–Hellman key exchange
ECDHE - Elliptic curve Diffie-Hellman
Key Exchange
Key exchange (also key establishment) is a method in cryptography by which cryptographic keys are
exchanged between two parties, allowing use of a cryptographic algorithm.
Digital Signatures
Digital Signature is a process that guarantees that the contents of a message have not been altered in
transit.
Session Keys
A session key is an encryption and decryption key that is randomly generated to ensure the security of a
communications session between a user and another computer or between two computers.
Key Stretching
Key stretching is the practice of converting a password to a longer and more random key for cryptographic
purposes such as encryption.
SUBTOPIC 3
Security Policy
Security policy is a definition of what it means to be secure for a system, organization or other entity.
Security Policy Components
Policy statement - Formal document outlining the ways in which an organization intends to conduct its
affairs and act in specific circumstances.
Standards - a level of quality or attainment.
Guidelines - a general rule, principle, or piece of advice.
Procedures - an established or official way of doing something.
Enforcement – This section should clearly identify how the policy will be enforced and how security
breaches and/or misconduct will be handled.
User Access to Computer Resources – This section should identify the roles and responsibilities of users
accessing resources on the organization’s network.
Security policies - The security vision should be clear and concise and convey to readers the intent of the
policy. security policy defines the goals and elements of an organization's computer systems.
Security Profiles – This section should include information that identifies how security profiles will be
applied uniformly across common devices
Sensitive data — This section addresses any information that is protected against unwarranted disclosure.
Passwords – This section should state clearly the requirements imposed on users for passwords. Length,
character set, # of times the password can be entered prior to it being disabled, # of days the password is
good for, and # of unique passwords required prior to reuse.
Common Security Policy Types
AUP – Acceptable User Policy - or fair use policy, is a set of rules applied by the owner, creator or
administrator of a network, website, or service, that restrict the ways in which the network, website or
system may be used and sets guidelines as to how it should be used.
Privacy policy - is a statement or a legal document that discloses some or all of the ways a party gathers,
uses, discloses, and manages a customer or client's data.
Audit policy defines account limits for a set of users of one or more resources. It comprises rules that
define the limits of a policy and workflows to process violations after they occur.
Extranet policy - this document describes the policy under which third-party organizations connect to
your networks for the purpose of transacting business related to your company
Password policy is a set of rules designed to enhance computer security by encouraging users to employ
strong passwords and use them properly.
Wireless standards policy - provides guidelines regarding wireless access points and the management by
ITS of 802.11X and related wireless standards access.
Social media policy is a living document that provides guidelines for your organization’s social media use.
It covers your brand’s official channels, as well as how employees use social media, both personally and
professionally.
Group Policy
Group Policy is a feature of the Microsoft Windows NT family of operating systems that controls the
working environment of user accounts and computer accounts.
Security Document Categories
System architecture - is the conceptual model that defines the structure, behavior, and more views of a
system
Change documentation should describe the requirements driving the change in enough detail to allow
approvers and other officials to make an informed decision on the change request.
Log is an official record of events during the operation
Inventories is a complete list of items such as property, goods in stock, or the contents of a building.
Change Management
A change management system will record what changes are made.
Three Levels of Change Management
• Individual Change Management
• Organizational/Initiative Change Management
• Enterprise Change Management Capability
Individual change management requires understanding how people experience change and what they
need to change successfully.
Organizational change management involves first identifying the groups and people who will need to
change as the result of the project, and in what ways they will need to change.
Enterprise change management is an organizational core competency that provides competitive
differentiation and the ability to effectively adapt to the ever-changing world.
Documentation Handling Measures
Classification is the action or process of classifying something according to shared qualities or
characteristics.
Identification
Identification is defined as the act of determining who someone or what something is. Identification is
the ability to identify uniquely a user of a system or an application that is running in the system.
Authentication
Authentication is the process of verifying the identity of a person or device.
Authentication Factors
Something you are Fingerprints, handprints, or retinal patterns
Something you have Key or ID card
Something you know Password or PIN
Somewhere you are or are not IP address or GPS
Something you do Keystroke patterns
Authorization
Authorization is the process of giving individuals access to system objects based on their identity.
Determining the rights and privileges of a user or entity
Non-repudiation
Non-repudiation is the assurance that someone cannot deny the validity of something. Nonrepudiation
prevents one party from denying actions they carry out.
Access Control
Determining and assigning privileges to resources, objects, or data. Manages authorization.
Accounting and Auditing
The process of tracking and recording system activities and resource access.
Common Security Practices
Implicit deny
Least privilege
Separation of duties
Job rotation
Mandatory vacation
Time of day restrictions
Privilege management
Implicit Deny
An implicit deny only denies a permission until the user or group can perform the permission.
Least Privilege
Least Privilege is a security discipline that requires that a user, system, or application be given no more
privilege than necessary to perform its function or job.
Separation of Duties
Separation of duties is a principle that prevents any single person or entity from being able to have full
access or complete all the functions of a critical or sensitive process.
Job Rotation
Job rotation is a concept that has employees rotate through different jobs to learn the procedures and
processes in each.
Mandatory Vacation
Mandatory vacations policies require employees to take time away from their job. These policies help to
reduce fraud and discover malicious activities by employees.
Time of Day Restrictions
Time of day restrictions limit when users can access specific systems based on the time of day or week.
Security Tokens
A security token (or sometimes a hardware token, hard token, authentication token, USB token,
cryptographic token, or key fob) is a physical device that an authorized user of computer services is given
to ease authentication.
Biometrics
Fingerprint scanner
Retinal scanner
Hand geometry scanner
Voice-recognition software
Facial-recognition software
Biometrics is an authentication method that identifies and recognizes people based on voice recognition
or physical traits such as a fingerprint, face recognition, iris recognition, and retina scan.
Keystroke Authentication
Keystroke dynamics has been used to strengthen password-based user authentication systems by
considering the typing characteristics of legitimate users.
Multifactor Authentication
When two or more authentication methods are used to authenticate someone, a multifactor
authentication system is being implemented.
Cryptography
Cryptography is a method of protecting information and communications using codes so that only those
for whom the information is intended can read and process it.
Encryption and Decryption
Encryption is a process which transforms the original information into an unrecognizable form.
Decryption is a process of converting encoded/encrypted data in a form that is readable and understood
by a human or a computer.
Ciphers
Cipher is a system of writing that prevents most people from understanding the message
Cipher Types
Stream ciphers create an arbitrarily long stream of key material, which is combined with plain text bit-by-
bit or character-by-character.
Block cipher takes a block of plain text and a key, and outputs a block of ciphertext of the same size.
Steganography
The art and science of hiding information by embedding messages within other, seemingly harmless
messages.
Types of Encryption
Encryption algorithms can be divided into three classes:
Symmetric
Asymmetric, and
Hash function.
Symmetric and Asymmetric encryption can encrypt and decrypt data.
A Hash function can only encrypt data; that data cannot be decrypted
Hashing Encryption
Hashing is one way to enable security during the process of message transmission when the message is
intended for a recipient only.
Hashing Encryption Algorithms
MD5 – (Message Digest)
SHA – (Secure Hash Algorithms)
NTLM versions 1 and 2 – New Technology LAN Manager
RIPEMD - RACE Integrity Primitives Evaluation Message Digest
HMAC - Hash-based Message Authentication Code
Key
An encryption key is a random string of bits created explicitly for scrambling and unscrambling data.
Symmetric Encryption
Symmetric encryption uses a single key to encrypt and decrypt data. Therefore, it is also referred to as
secret-key, single-key, shared-key, and private-key encryption.
Symmetric Encryption Algorithms
DES - Data Encryption Standard
3DES – Triple Data Encryption Standard
AES - Advanced Encryption Standard
Blowfish
Twofish
RC 4, 5, 6
Asymmetric Encryption
Asymmetric encryption, also known as public key cryptography, uses two mathematically related keys.
One key is used to encrypt the data, while the second key is used to decrypt the data.
Asymmetric Encryption Techniques
RSA - Rivest–Shamir–Adleman
DH - Diffie–Hellman key exchange.
ECC - Elliptic curve cryptography
DHE - Diffie–Hellman key exchange
ECDHE - Elliptic curve Diffie-Hellman
Key Exchange
Key exchange (also key establishment) is a method in cryptography by which cryptographic keys are
exchanged between two parties, allowing use of a cryptographic algorithm.
Digital Signatures
Digital Signature is a process that guarantees that the contents of a message have not been altered in
transit.
Session Keys
A session key is an encryption and decryption key that is randomly generated to ensure the security of a
communications session between a user and another computer or between two computers.
Key Stretching
Key stretching is the practice of converting a password to a longer and more random key for cryptographic
purposes such as encryption.