Chapter 1: Information Security
1. Information Security :
- Definition: Protecting information and information systems from unauthorized access, use,
disclosure, disruption, modification, or destruction.
- CIA Triad:
- Confidentiality: Ensuring information is accessible only to authorized individuals.
- Integrity: Maintaining the accuracy and completeness of information.
- Availability: Ensuring information is accessible when needed.
2. Approaches to Information Security Implementation:
- Top-Down Approach: Initiated by senior management, who set policies and allocate
resources. Ensures alignment with business goals.
- Bottom-Up Approach: Initiated by technical staff, focusing on specific systems or issues.
Often lacks organizational support.
- Key Takeaway: A top-down approach is more effective for long-term success.
3. The Systems Development Life Cycle (SDLC) - Waterfall Methodology:
- Phases:
1. Planning: Define project scope, goals, and feasibility.
2. Analysis: Gather and document system requirements.
3. Design: Create system architecture and specifications.
4. Implementation: Develop, test, and deploy the system.
5. Maintenance: Monitor, update, and fix issues post-deployment.
- Security Integration: Security must be embedded in every phase (e.g., risk assessment in
planning, secure coding in implementation).
Chapter 2: Threats and Attacks
1. Threats and Attacks:
- Threat: Any potential danger to information or systems (e.g., malware, natural disasters).
- Attack: An intentional act to exploit vulnerabilities and cause harm (e.g., phishing,
ransomware).
2. 12 Categories of Threat:
- Malware: Malicious software like viruses, worms, and Trojans.
- Phishing: Fraudulent attempts to obtain sensitive information via email or messaging.
- Insider Threats: Malicious or negligent actions by employees or contractors.
- Denial of Service (DoS/DDoS): Overwhelming a system to make it unavailable.
- Man-in-the-Middle (MitM): Intercepting and altering communication between two parties.
- Password Attacks: Brute force, dictionary attacks, or credential stuffing.
- Social Engineering: Manipulating individuals to divulge confidential information.
- Advanced Persistent Threats (APTs): Long-term targeted attacks by skilled adversaries.
- Zero-Day Exploits: Attacks targeting unknown vulnerabilities.
- Ransomware: Encrypting data and demanding payment for decryption.
- Physical Threats: Theft, vandalism, or natural disasters affecting hardware.
- IoT-Based Threats: Exploiting vulnerabilities in Internet of Things devices.
Chapter 3: Ethics and Professional Organizations
The Ten Commandments of Computer Ethics (Computer Ethics Institute)
1. Do not use a computer to harm others.
2. Do not interfere with others' computer work.
3. Do not snoop in others' computer files.
4. Do not use a computer to steal.
5. Do not use a computer to bear false witness.
6. Do not copy or use proprietary software without paying.
7. Do not use others' computer resources without authorization.
8. Do not appropriate others' intellectual output.
9. Think about the social consequences of the program you write.
10. Use a computer in ways that show consideration and respect.
2. Codes of Ethics of Professional Organizations:
- (ISC)² Code of Ethics: Protect society, act honorably, provide diligent service, and advance
the profession.
- ISACA Code of Ethics: Support governance, maintain confidentiality, and act with integrity.
- IEEE Code of Ethics: Prioritize public safety, avoid conflicts of interest, and be honest in
research.
3. Major IT and Infosec Professional Organizations:
- (ISC)²: Offers CISSP certification; focuses on cybersecurity best practices.
- ISACA: Offers CISA and CISM certifications; focuses on IT governance and auditing.
- CompTIA: Offers Security+ certification; focuses on foundational IT security skills.
- SANS Institute: Provides training and certifications like GIAC; focuses on hands-on infosec
skills.
Chapter 4: Planning and Governance
1. Different Types of Planning:
- Strategic Planning: Long-term goals and policies (e.g., 5-year security roadmap).
- Tactical Planning: Medium-term actions to achieve strategic goals (e.g., annual security
projects).
- Operational Planning: Day-to-day activities to maintain security (e.g., monitoring, patching).
2. Information Security Governance Outcomes:
- Risk Management: Identifying, assessing, and mitigating risks.
- Compliance: Adhering to laws, regulations, and standards (e.g., GDPR, HIPAA).
- Alignment: Ensuring security supports business objectives.
3. Information Security Policy, Standards, and Practices:
- Policy: High-level rules (e.g., Acceptable Use Policy).
- Standards: Specific requirements (e.g., password complexity standards).
- Practices: Detailed procedures (e.g., incident response steps).
4. Continuity Strategies/Planning:
- Business Continuity Planning (BCP): Ensuring critical business functions continue during
disruptions.
- Disaster Recovery Planning (DRP): Restoring IT systems and data after a disaster.
- Key Components: Risk assessment, backup strategies, recovery time objectives (RTOs),
and recovery point objectives (RPOs).