Certification in Cybersecurity

In the context of security, these are the three main pillars of information security, and they are
often referred to as the CIA triad.
Adequate Security:
Security commensurate with the risk and the magnitude of harm resulting from the loss,
misuse or unauthorized access to or modification of information. Source: OMB Circular
A-130

CIA stands for Confidentiality, Integrity, and Availability.

1. Confidentiality:

Refers to protecting information from unauthorized access “Not

disclosed”.

 Risks:
o Cryptoanalysis
 How to Mitigate:
o Encryption
o Access Control
 Example:
1- Personally Identifiable information (PII)
2- Protected Health Information (PHI)
2. Integrity:

Data are trustworthy, complete, and have not been accidentally altered or
modified by an unauthorized user.

 Risks:
o Malware
o Hacker
 How to Mitigate:
o Hash “‫”داتا مشوهة ملخبطة‬
o Digital Signature
o Access Control
 3. Availability:

Data is accessible/ Available when you need it.

 Risks:
o Denial of Service (DOS Attack).
o Disaster.
 How to Mitigate:
o Backup
o Physical Protection
o Redundancy ‫الوفرة في الوصول والبيانات واالتصال‬
o High Availability
 Example:
3- Personally Identifiable information (PII)
4- Protected Health Information (PHI)
In the AAA framework context, these are the three main pillars of Confidentiality.
1. Authentication (Who are you):
- The process of verifying the identity of a user or device.
- The Act of identifying or verifying the eligibility of a station, originator, or individual to
access specific categories of information.
o Authentication Methods
A. Something you Know
 Username.
 Password.
 Security Question.
B. Something you have
 Smartphone.
 Hardware Key.
 Smart Card.
C. Something you are
 Fingerprint.
 Face ID.
 Eye Printer.
 2. Authorization (what permission do you have?)

The right or permission that is granted to a system entity to access a system resources.

The process of granting access to resources is based on a:

 user's identity and
 privileges.
o Example:
A. Rolls in the European Union.
 In General Data Protection Regulation (GDPR):
 Privacy.
Non-repudiation (( ‫عدم االنكار‬

The inability to deny taking an action such as creating information, approving information, and
sending or receiving messages.

 Data Privacy: ‫كيفية حماية الداتا بحيث ان توصل لألشخاص الخاصة فيهم وما حد‬
‫ثاني يطلع عليها‬

Defines how data is collected, stored & distributed.

 Data Security: ‫كيفية احمي الداتا من ان تخترق او اشخاص غير مصرح الهم‬
‫يوصلوها‬

Tools, processes & controls are used to safeguard data.

What is Privacy? ‫حق الفرد في ان يتحكم في نشر المعلومات الخاصة فيه لألشخاص الي بشوفهم‬
‫صح‬

It is the right of an individual to control the distribution of information about themselves.

3. Accounting:
The process of tracking who has accessed data and what they have done with it.

In addition to AAA security, there are other important security measures that organizations
can take to protect confidentiality. These include:
A. Data Encryption.
B. Physical Security.
C. Security Policies and Procedures.
 Risk Management
What is Information security risk:

Reflect the potential adverse impacts that result from the possibility of unauthorized access, use
disclosure, disruption, modification or destruction of information and/or information system.

Responsible from:

1- Security Administrator.

2- Security Engineer.

Risk Analysis:

I should do this every day and give a report to the manager with the solution/ suggestion’s
solution.

Risk = Impact * Likelihood

Risk Management Terminology

1- Assets (‫)األصول‬.

is something in need of protection. ‫أي شيء له قيمة يحتاج للحماية‬

2- Vulnerability (‫)الثغرات – مواطن االختراق‬.

is a gap or weakness in those protection efforts.

‫هي الثغرات الموجودة في وسيله الحماية الي وفرتها وممكن من خاللها شخص يخترقها‬.

Brute force Attack‫تشفير البيانات مثال ممكن استخدم خاصيه موجودة في كالي لينكس‬
‫اسمها‬

‫ ف بحاول االقي حل الها‬،‫هي التولز بتتوقع كلمه السر الخاصة بالملفات المشفرة‬.

3- Threats (‫)التهديدات‬.

is something or someone that aims to exploit a vulnerability to reduce protection efforts.

)‫هو استغالل هي الثغرة ب أي طريقه والوصول ألها (شغالت غير ملموسة‬.

a. Natural (‫)طبيعية‬. ‫الفياضان والزالزل‬

 b. Unintentional (‫)غير مقصودة‬. ‫الملفات التي تصل الى األقسام غير المقصودة‬
c. Intentional (‫)مقصودة‬. ‫االختراقات‬

Risk ‫ هو‬asset ‫ جواه‬Vulnerability ‫ وفي‬Threat

‫المخاطر هو أصول جواها ثغرة وفي الها تهديد‬

 Threat actors in Cyber Security are:

 Insiders (‫)"من داخل الشركة او المنظمة “تهديد داخلي‬.

 Outsider (‫)"من خارج الشركة او المنظمة “تهديد خارجي‬.
 Formal entities that are nonpolitical (such as business competitors and
cybercriminals). ‫المنافسين للشركات من شركات أخرى او الهاكرز‬
 Formal entities that are political (such as terrorists, nation-states, and
hacktivists). ‫حروب اإللكترونية بين الدول زي أوكرانيا وروسيا‬
 Intelligence or information gatherers (could be any of the above). ‫االمن‬
‫القومي الخاص بالدولة‬.
 Technology (such as free-running bots and artificial intelligence , which
could be part of any of the above).
Risk Process

1- Risk Identification: ‫تحديد المخاطر‬

Gather information about all risks. ‫جمع المعلومات عن كل المخاطر‬
2- Risk Assessment: ‫تقييم المخاطر‬
the process of identifying, estimating and prioritizing risks to an organization’s
operations (including its mission, functions, image, and reputation), assets, individuals,
other organizations. ‫تحديد وتقدير وترتيب أولويات المخاطر‬
‫لعمليات المنظمة‬.
‫يجب ارفاق رفع تقرير عن الثغرة مع الحل او اقتراح للحل‬.

* Qualitative risk assessment. * Quantitative risk assessment

(Low, Medium, High). (Numbers).

3- Risk Treatment: ‫معالجة المخاطر‬

The Risk control should be less than Risk value.

 Accept the Risk: ‫تقبل المشكلة وطنشها‬

No action is taken “Ignoring Risks”.

 Avoid the Risk: ‫ ال داعي للمخاطره‬،‫اتجنب المشكلة وال أتوقع حصولها‬

The decision to attempt to eliminate the risk entirely.

 Reduce (Mitigate) the Risk:

Taking Action to prevent

 Transfer or share the Risk:

Passig risk to a third party.

‫احتمالية حدوث الريسك وتأثيره‬

Risk Analysis Definitions:

Residual Risk “Risk Appetite”: = ‫المخاطر التي ليس لها حلول ويجب علي تقبلها‬
2000 $
Security Risk Remaining after Implementation Controls.

Risk Tolerance: ‫المخاطرة الي بضيفها على المخاطرة الي تقبلتها تحسبا ان حدث‬
2500 ‫شيء غير متوقع أكون جاهز‬$

The level of risk an entity is willing to assume to achieve a potential desired.

Control Gap:500$

The amount of protection the control can’t provide

‫ وتكلفه حل المشكلة الي رح اتقبلها‬%50 ‫ لو انا عندي برنامج واحتمالية وقوعه هي‬:‫مثال‬
‫ يعني‬$2000 ‫ بدل‬$25000 ‫ بجي بعمل حسابي مثال على‬$2000 ‫رح تصير غصب عني هي‬
‫ الي هي تحسبا لو صار شي غير متوقع‬$500 ‫في زيادة‬

Security Controls
Security Controls (Counter Masure):

Act as safeguards or countermeasures prescribed for an information system or assets to protect

the CIA of the system and its information. Implementation of security controls is expected to
reduce risk to an acceptable level.

Three types of security controls:

1- Physical Controls: