Domain 1: Security Principles complete

CIA
The CIA Triad (Confidentiality, Integrity, and Availability) is a foundational
concept in cybersecurity that defines the core principles for securing
information systems. Here's a breakdown of each component:

1. Confidentiality:

o This principle ensures that information is only accessible to

those authorized to view it.

o It protects sensitive data from unauthorized access and

disclosure, preventing data breaches.

o Example: Using encryption to protect data during

transmission.

2. Integrity:

o Integrity ensures that data is accurate, complete, and

trustworthy.

o It involves safeguarding the accuracy and consistency of data

over its lifecycle.

o Example: Implementing checksums and hashes to verify data

integrity and prevent unauthorized modification.

3. Availability:

o Availability ensures that information and systems are

accessible and functional when needed.

o This principle involves ensuring that systems are resilient and

capable of handling requests without interruptions.

o Example: Implementing disaster recovery plans and

redundant systems to prevent downtime.

Together, these principles form the foundation of any security strategy,

helping organizations safeguard their systems, data, and resources
against unauthorized access, tampering, and disruptions. They also make
security concepts easier for non-technical stakeholders to understand and
appreciate.

CIA Triad
The CIA Triad offers a framework for ensuring the security and reliability
of systems, data, and operations. Let’s delve deeper into each of the
principles:

1. Confidentiality

Confidentiality focuses on protecting sensitive information from

unauthorized access and ensuring that only authorized users can view or
modify specific data. Achieving confidentiality can be challenging,
particularly in environments with various users who may access the
system from compromised devices or mobile applications. Security
measures like access control, encryption, and authentication are key
to managing confidentiality.

 Personally Identifiable Information (PII): This refers to data

that can identify an individual, like names, addresses, phone
numbers, and more. Protecting PII is critical to maintaining
confidentiality.

 Protected Health Information (PHI): Includes sensitive data

related to an individual’s health status. This must be kept
confidential, especially in healthcare-related sectors.

 Sensitivity: The degree of importance assigned to information and

its need for protection. Sensitive data, if disclosed or modified
improperly, can cause significant harm to individuals or
organizations.

In practice, confidentiality measures ensure that sensitive data (e.g.,

intellectual property, trade secrets, business plans) is restricted from
unauthorized parties.

2. Integrity

Integrity is about maintaining the accuracy and consistency of information

over time. This principle ensures that the data has not been tampered
with, intentionally or unintentionally, and remains complete and
consistent.

 Data Integrity: Protects information from unauthorized

modification or corruption, ensuring its accuracy during storage,
processing, and transmission.

 System Integrity: Refers to maintaining a known good

configuration of systems and ensuring that the system operates as
expected. A baseline configuration is key for system integrity. If
the current state deviates from the baseline, it indicates a
compromise or error.
  Internal Consistency: Ensures that data across systems is
identical in content, meaning, and format. For instance, the same
data stored in multiple systems should match and not show
discrepancies.

Integrity helps organizations ensure that information is reliable, complete,

and trustworthy.

3. Availability

Availability ensures that systems and data are accessible when authorized
users need them, in the format they require. It’s not about having systems
and data 100% available all the time, but ensuring timely and reliable
access based on business needs.

 Criticality: Some data or systems are more vital than others, and
availability strategies must be tailored to these critical assets. For
instance, an online payment system requires much higher
availability than a backup database.

 Business Consultation: Security professionals work with the

business to identify critical systems and ensure their availability
aligns with operational needs. Disaster recovery and redundancy
strategies help improve availability.

 Reliability: Systems should be consistently available, with minimal

downtime and rapid recovery in case of failures.

In many industries, maintaining availability is a legal or regulatory

requirement (e.g., healthcare, finance), where system uptime directly
impacts business operations.

Protecting Integrity, Confidentiality, and Availability

Achieving all three aspects of the CIA Triad requires a well-coordinated

security approach that balances these principles. Implementing
safeguards like:

 Access Controls: To protect confidentiality and ensure only

authorized users can access certain information.

 Encryption and Hashing: To ensure the integrity of data and

prevent unauthorized modifications.

 Redundancy and Backups: To ensure availability and quick

recovery in case of system failures or attacks.
Authentication and Its Role in Confidentiality
Authentication is a crucial process in ensuring confidentiality within
information security. It verifies that the user requesting access to a
system or data is indeed the authorized individual, protecting sensitive
information from unauthorized access. The authentication process
ensures that only those with valid credentials can interact with systems,
which is key to preserving confidentiality.

Methods of Authentication

There are three common methods of authentication, each designed to

validate a user's identity based on something they know, have, or are:

1. Something You Know:

o Passwords: The most common form of authentication,

requiring users to enter a secret password or passphrase. This
is typically the first line of defense.

o Passphrases: Longer and more complex versions of

passwords, often combining random words or characters,
which improve security.

o Vulnerabilities: Passwords can be weak if not complex

enough, and users often reuse passwords across different
platforms, making them susceptible to breaches.

2. Something You Have:

o Tokens: Physical devices that generate a code at regular

intervals, used in conjunction with a password for two-factor
authentication (2FA).

o Smart Cards: Physical cards that contain embedded chips,

often used for access control or to log into secure systems.

o Memory Cards: Storage devices used to store credentials or

cryptographic keys to authenticate the user.

o Vulnerabilities: If a token, smart card, or memory card is lost

or stolen, unauthorized users could gain access if proper
safeguards (like PINs) are not in place.

3. Something You Are:

o Biometrics: Uses unique physical characteristics, such as

fingerprints, facial recognition, or retinal scans, to verify
identity.
 o Measurable Characteristics: Other biometric data could
include voice recognition, iris scans, or even behavioral traits
like typing patterns or gait analysis.

o Vulnerabilities: Biometrics can be compromised (e.g., facial

recognition systems can be tricked with photos) or difficult to
modify if breached.

Authentication in the Context of Confidentiality

Confidentiality relies heavily on strong authentication to ensure that only
legitimate users can access sensitive data. Once authentication is
established, it prevents unauthorized access, thereby protecting the
confidentiality of data. A breach in authentication (such as weak
passwords or stolen tokens) can lead to data exposure, violating
confidentiality.

By leveraging different authentication methods, organizations can achieve

stronger security controls and enhance their ability to safeguard
confidential information. This may include:

 Multi-Factor Authentication (MFA): Combining at least two of

the three methods (something you know, have, or are) to create
layers of defense. For example, using both a password and a smart
card to authenticate.

 Adaptive Authentication: This approach assesses the risk level

based on contextual factors (e.g., location, device used) and
requires additional authentication steps if suspicious activity is
detected.

In essence, authentication is a vital mechanism that upholds

confidentiality, ensuring that only authorized users can access sensitive
information while minimizing the risk of unauthorized disclosure.

Methods of Authentication

ChatGPT said:

Here's a table comparing Single-Factor Authentication (SFA) vs. Multi-Factor

Authentication (MFA):
 Single-Factor Authentication Multi-Factor Authentication
Feature
(SFA) (MFA)
Number of Two or more (Combination of
One (Knowledge, Token, or
Authentication Knowledge, Token, or
Characteristic)
Factors Characteristic)
Password + OTP, Smart Card +
Examples Password, PIN, Smart Card Fingerprint, Facial Recognition +
PIN
Lower security – vulnerable to Higher security – protects
Security Level password attacks, phishing, and against stolen credentials and
brute-force attacks unauthorized access
Slightly more complex but
Ease of Use Simple and easy to implement
significantly improves security
Even if one factor is
If the single factor is compromised,
Vulnerability compromised, another factor is
an attacker can gain full access
required for access
Banking, corporate networks,
Basic user logins, personal
Common Use Cases government systems, cloud
accounts, low-security applications
services

MFA is the recommended approach for stronger security and better protection against
unauthorized access

Non-Repudiation
Definition:
Non-repudiation is a legal concept that ensures an individual cannot falsely deny
performing a particular action. It provides proof that a specific user:

 Created information (e.g., drafting a legal document).

 Approved information (e.g., digitally signing a contract).
 Sent or received a message (e.g., email confirmations, financial transactions).

Importance in Digital Transactions:

In today’s world of e-commerce and electronic transactions, impersonation and fraudulent
denial of actions (e.g., making an online purchase and later denying it) are potential risks.
Non-repudiation ensures that individuals are held accountable for their actions, maintaining
trust in online interactions.

Methods of Achieving Non-Repudiation:

1. Digital Signatures – Provides cryptographic proof that a message or document was

signed by a specific individual.
2. Audit Logs – Records actions taken by users for later verification.
3. Timestamping – Ensures a transaction occurred at a specific time.
4. Message Authentication Codes (MACs) – Confirms message integrity and sender
authenticity.
Non-repudiation methodologies protect both users and organizations by ensuring that
electronic transactions are secure, verifiable, and legally enforceable.

Privacy
Definition:
Privacy is the right of an individual to control the distribution, collection, and use of their
personal information.

While privacy and security both focus on protecting sensitive data, privacy emphasizes who
has access to the data and how it is shared, whereas security focuses on protecting it from
threats.

With the rapid increase in data collection and storage, compliance with privacy laws and
regulations is becoming more critical across industries.

Global Privacy Regulations

General Data Protection Regulation (GDPR)

 Enacted by the European Union (EU) in 2016, GDPR classifies personal privacy as
a fundamental human right.
 It applies to all organizations (domestic or foreign) that do business in the EU or
process the personal data of EU citizens.
 Member nations of the EU enforce GDPR through national laws, sometimes adding
stricter requirements.

U.S. Privacy Laws & Global Impact

 Companies operating in the United States must comply with state-level privacy
laws, such as:
o California Consumer Privacy Act (CCPA) – Governs data collection and
consumer rights.
o Health Insurance Portability and Accountability Act (HIPAA) – Protects
healthcare-related information.
 Privacy laws apply beyond physical borders—any entity handling personal data of
individuals in a specific jurisdiction must comply with its laws.

Why Privacy Compliance is Important

 Legal Consequences: Failure to comply can lead to fines, penalties, and legal
action.
 Consumer Trust: Strong privacy policies enhance customer confidence in
organizations.
  Regulatory Challenges: Privacy laws frequently change, requiring organizations to
stay updated and ensure proper data protection practices.

Risk Management in Cybersecurity

Security professionals apply their knowledge and skills to:

 Assess operational risks and identify potential threats.

 Use risk data effectively for decision-making.
 Work cross-functionally with different teams.
 Report findings to stakeholders with actionable insights.

Understanding key risk management terminology is essential for cybersecurity

professionals

Risk Management Terminology

Term Definition
Something valuable that requires protection (e.g., data, systems,
Asset
infrastructure).
A weakness or gap in security that could be exploited (e.g., outdated software,
Vulnerability
misconfigurations).
An entity or event that attempts to exploit a vulnerability (e.g., hackers,
Threat
malware, insider threats).

Effective risk management involves identifying these elements and implementing security
controls to mitigate potential risks.

Threats, Vulnerabilities, and Likelihood in Risk

Management
Risk management involves understanding the relationships between threats, vulnerabilities,
and likelihood to assess and mitigate security risks effectively.

Key Terminology

Term Definition Example

A potential danger that could
Threat Malware, hackers, natural disasters.
exploit a vulnerability.
A weakness in a system that can
Vulnerability Unpatched software, weak passwords.
be exploited.
The probability of a threat High for exposed internet-facing systems,
Likelihood
exploiting a vulnerability. low for well-secured networks.
Understanding Likelihood in Risk Assessment
 Likelihood is the probability of a threat successfully exploiting a vulnerability.
 It is determined by factors such as:
o Threat actor capability (e.g., script kiddie vs. nation-state hacker).
o Exposure level (e.g., public-facing server vs. isolated internal system).
o Existing security controls (e.g., firewalls, IDS, encryption).
 Organizations use risk matrices to evaluate low, medium, or high likelihood levels
and prioritize security measures accordingly.

Risk Identification in Cybersecurity

Risk identification is not a one-time task—it is an ongoing process of:

1. Recognizing potential risks that could impact an organization.

2. Characterizing these risks based on severity and likelihood.
3. Estimating their potential impact on business operations.

Security professionals continuously analyze their organization’s strategic, tactical, and

operational plans to stay ahead of emerging threats.

How to Identify Risks

Risk identification involves both observation and analysis.

Think about how you assess risks in everyday life:

 Watching for traffic while crossing a street.

 Avoiding puddles to prevent slipping.
 Noticing loose wires or wet floors at work.

Similarly, in cybersecurity, risk identification requires a proactive mindset—security

professionals dig deeper to uncover hidden vulnerabilities.

Key Takeaways on Risk Identification

Concept Explanation
Clear Communication Identifying risk allows for better communication with stakeholders.
Shared Responsibility Employees at all levels contribute to risk identification.
Recognizing risks helps mitigate potential threats before they
Prevention Focus
escalate.

Security professionals play a crucial role in risk assessment by analyzing processes,

controls, monitoring, and incident response strategies.

In smaller organizations with limited risk management programs, cybersecurity experts

have an opportunity to build and enhance risk mitigation plans.
Risk Assessment in Cybersecurity
Risk assessment is the process of identifying, estimating, and prioritizing risks that may
impact an organization’s:

 Operations (mission, functions, reputation).

 Assets (systems, data, infrastructure).
 Individuals (employees, customers).
 Other organizations and even national security (in regulated industries).

Key Aspects of Risk Assessment

Concept Explanation
Includes threat and vulnerability assessments, considering security
Risk Analysis
controls in place.
Management Sometimes requires an in-depth risk assessment by internal or external
Decision auditors.
Alignment with Risks should be associated with business objectives, ensuring security
Goals aligns with mission-critical operations.

Example: Risk of Fire in a Data Center

A risk assessment evaluates different ways to mitigate fire-related risks:

Mitigation Effectiveness Considerations

Fire Alarms Alerts personnel to evacuate Does not stop fire spread
Sprinkler Systems Minimizes damage Could destroy IT systems and data
Gas-based Systems Protects IT infrastructure Expensive but prevents system damage

The risk assessment helps prioritize mitigation strategies based on their costs and impact.

Final Risk Assessment Report

 The assessment results are documented as a report or presentation.

 This report is used by management to review, approve, and prioritize security
investments.

Risk Treatment in Cybersecurity

Risk treatment involves making strategic decisions about how to handle identified and
prioritized risks. The approach depends on management’s risk tolerance, available
resources, and mitigation costs.

Types of Risk Treatment

Risk Treatment
Description Example
Option
A company discontinues a
Eliminating the risk entirely by stopping the
Risk Avoidance product line due to security
activity that causes it.
vulnerabilities.
Installing firewalls,
Implementing controls to reduce the impact
Risk Mitigation encryption, or multi-factor
or likelihood of a risk occurring.
authentication (MFA).
Acknowledging the risk and taking no A company accepts minor
Risk
action, often because the cost of mitigation data breaches that do not
Acceptance
is too high compared to the potential loss. impact critical data.
Purchasing cyber insurance
Risk Shifting the financial responsibility of a risk
to cover potential data breach
Transference to a third party (e.g., insurance providers).
costs.

Key Considerations for Risk Treatment

 Business Impact – How critical is the risk to business operations?

 Likelihood of Occurrence – Is the risk highly probable or rare?
 Cost vs. Benefit – Does the cost of mitigation outweigh potential losses?
 Regulatory Compliance – Are there legal requirements for handling certain risks?

Risk Prioritization in Cybersecurity

After identifying risks, organizations must prioritize and analyze them using qualitative
and quantitative risk analysis techniques. Understanding the mission and business
functions helps put risks into context, determine root causes, and create actionable risk-
response strategies.

Risk Analysis Methods

Method Description Example Use Case

Uses expert judgment, experience, and Determining security
Qualitative Risk
categorization to assess risks. Often represented threats based on expert
Analysis
in risk matrices. opinions.
Quantitative Assigns numerical values (e.g., financial Calculating potential
Risk Analysis impact, probabilities) to assess risk. Uses losses from a
 Method Description Example Use Case
formulas like Annual Loss Expectancy (ALE). cyberattack.

Risk Matrix for Prioritization

Impact / Probability Low Probability High Probability

Low Impact Low Priority Moderate Priority
High Impact Moderate Priority High Priority

 Low Probability + Low Impact → Minor concerns, often accepted.

 High Probability + Low Impact → May require monitoring or minor mitigation.
 Low Probability + High Impact → Requires preventive measures if impact is
severe.
 High Probability + High Impact → Critical risk, requiring immediate action.

Why Prioritize Risks?

 Aligns risk response with business priorities.

 Optimizes resource allocation for mitigation.
 Improves incident response and preparedness.
Decision Making Based on Risk Priorities
Organizations must evaluate risk likelihood, impact, and tolerance when making
decisions based on risk priorities. Different industries and locations face unique
risks, requiring tailored approaches to risk management.

Key Factors in Risk-Based Decision Making

Factor Description Example

A Hawaii-based company considers
The probability of a risk event
Likelihood volcanic eruptions more likely than a
occurring.
Chicago-based one.
A data breach could lead to financial
The potential consequences of
Impact losses, legal penalties, and reputational
a risk event.
damage.
The level of risk an Some companies invest heavily in
Risk Tolerance organization is willing to cybersecurity, while others accept
accept. minimal risks.
Laws and regulations that
Regulatory Ignoring asbestos exposure risks can lead
mandate risk management
Compliance to legal liability.
practices.
Weighing the cost of risk Investing in blizzard preparedness in
Cost-Benefit
mitigation against the potential Chicago vs. the risk of operational
Analysis
loss. shutdowns.

Example: Industry-Specific Risk Decisions

Primary Risk
Industry Risk Tolerance Approach
Consideration
Patient data breaches
Healthcare Low tolerance → Strong cybersecurity.
(HIPAA violations)
Low tolerance → Strict fraud detection
Finance Fraud and insider threats
measures.
Moderate tolerance → Backup suppliers &
Manufacturing Supply chain disruptions
logistics planning.
Market volatility & cyber Varied tolerance → Risk-taking for
Tech Startups
threats innovation, but security compliance.

Why Risk-Based Decision-Making Matters?

✅ Protects business operations and employees
✅ Minimizes legal and financial exposure
✅ Aligns risk strategy with corporate goals
✅ Improves resilience against disruptions

Risk Tolerance in Organizations

Risk tolerance is an organization's willingness to accept risk in pursuit of its objectives.
Management determines acceptable vs. unacceptable risks, which can vary between
departments, industries, and locations.

Key Factors in Risk Tolerance

Factor Description Example

How much risk an A startup may take high financial risks,
Management’s Risk
organization is willing to while a bank has a low appetite for fraud
Appetite
take. risk.
Aerospace has zero tolerance for safety
Industry-Specific Different industries have
failures, but marketing firms tolerate
Risk different risk tolerances.
experimental risks.
Icelandic businesses prepare for volcanic
Geographic Location-based risks
eruptions, while Florida companies
Considerations influence tolerance.
prioritize hurricane risks.
Acceptable levels of A financial trading platform cannot afford
Downtime
system failure or any downtime, while a blog website may
Tolerance
disruption. tolerate short outages.
The board or leadership
Board & Executive If power outages are a concern, leadership
determines acceptable risk
Decisions may invest in redundant power sources.
levels.

Risk Tolerance in Action

Risk Tolerance
Example Scenario Risk Response
Level
A startup experimenting with new Accepts uncertain outcomes for
High Tolerance
marketing strategies. innovation.
Moderate A manufacturing company handling Balances risk vs. cost by
Tolerance occasional supply chain delays. maintaining backup suppliers.
Strict risk mitigation via
A hospital ensuring 24/7 access to
Low Tolerance redundant power & backup
patient records.
systems.

Why Risk Tolerance Matters?

✅ Aligns security strategy with business goals

✅ Determines investment in risk mitigation measures
✅ Ensures compliance with industry regulations
✅ Helps in business continuity planning
Security Controls: Safeguarding Information &
Systems
Security controls are mechanisms that protect Confidentiality, Integrity, and Availability
(CIA) of systems and data. They help reduce risk to an acceptable level by preventing,
detecting, or responding to security threats.

Types of Security Controls

Category Description Examples

Restrict physical access to Security guards, badge readers,
Physical Controls facilities, assets, and fences, surveillance cameras, locks,
information. fire suppression systems.
Firewalls, encryption, intrusion
Use technology to protect
Technical (Logical) detection systems (IDS), antivirus
systems and data from
Controls software, multi-factor authentication
unauthorized access.
(MFA).
Policies, procedures, and
Administrative Security awareness training, incident
training to guide employee
(Managerial) response plans, password policies,
behavior and enforce security
Controls access control policies.
measures.

Security Control Breakdown

🔹 Physical Controls

 Prevent unauthorized physical access to sensitive areas.

 Example: Data centers use biometric authentication and 24/7 surveillance.

🔹 Technical Controls

 Protect digital systems from cyber threats.

 Example: Encryption ensures that data remains secure even if intercepted.

🔹 Administrative Controls

 Set rules and policies for security compliance.

 Example: A security policy mandates that employees change passwords every 90
days.

Why Are Security Controls Important?

✅ Reduce cybersecurity threats (e.g., hacking, data breaches).
✅ Ensure compliance with industry regulations (e.g., ISO 27001, GDPR, NIST).
✅ Minimize operational disruptions due to security incidents.
✅ Protect sensitive data and maintain trust with customers.

Governance Framework: Laws, Standards, Policies, and Procedures

Effective governance ensures that organizations comply with regulations, follow industry
standards, and implement policies and procedures to achieve their business objectives
while maintaining security and compliance.

Hierarchy of Governance Elements

1️⃣ Regulations & Laws

 Created by governments to enforce public policies.

 Non-compliance results in legal consequences (fines, lawsuits, criminal charges).
 Examples:
o HIPAA (Health Insurance Portability and Accountability Act) – Protects
health data in the U.S.
o GDPR (General Data Protection Regulation) – Controls personal data of
EU citizens.
o SOX (Sarbanes-Oxley Act) – Regulates financial reporting and auditing in
the U.S.

2️⃣ Standards

 Provide frameworks for security, compliance, and best practices.

  Developed by organizations & regulatory bodies.
 Examples:
o ISO 27001 – Information Security Management System.
o NIST (National Institute of Standards and Technology) – U.S.
cybersecurity standards.
o IEEE (Institute of Electrical and Electronics Engineers) – Defines IT and
telecom standards.

3️⃣ Policies

 High-level guidelines created by executive management to align with standards &

regulations.
 Provide direction but are not step-by-step instructions.
 Examples:
o Data Protection Policy – Defines how customer data is secured.
o Acceptable Use Policy (AUP) – Specifies allowed IT resource usage.
o Incident Response Policy – Defines response to security incidents.

4️⃣ Procedures

 Step-by-step instructions to implement policies.

 Ensure consistency and repeatability of security and operational processes.
 Examples:
o Password Reset Procedure – Steps to reset a corporate password securely.
o Incident Handling Procedure – How to report and respond to cyber threats.
o Employee Onboarding Procedure – Steps for granting IT access to new
employees.

Why Is Governance Important?

✅ Ensures legal compliance to avoid fines and legal actions.

✅ Aligns IT security & business goals with international standards.
✅ Improves cyber resilience by defining clear security policies and procedures.
✅ Enhances data protection and prevents breaches.

Domain 2: Incident Response, Business

Continuity and Disaster Recovery Concepts

Incident Terminology and Cybersecurity Events

Security professionals work to prevent, detect, and respond to security threats. Despite these
efforts, incidents occur due to malicious attacks, system vulnerabilities, or human errors.
Understanding incident response starts with familiarizing oneself with key terminology used
in cybersecurity.

Key Cybersecurity Terms

1. Event
o Any observable action or occurrence within a network or system.
o Examples: A failed login attempt, a file modification, or network traffic
spikes.
o Reference: NIST SP 800-61 Rev 2
2. Incident
o An event (or series of events) that actually or potentially jeopardizes the
Confidentiality, Integrity, or Availability (CIA) of an information system.
o Example: A malware infection, unauthorized data access, or a system breach.
3. Threat
o Any situation, event, or action that could cause harm to an organization’s
systems, data, or operations.
o Threats can be intentional (cyberattacks) or unintentional (system failures,
natural disasters).
o Reference: NIST SP 800-30 Rev 1
4. Vulnerability
o A weakness in an information system, security policies, or controls that could
be exploited by a threat.
o Example: Unpatched software, weak passwords, or misconfigured firewalls.
o Reference: NIST SP 800-30 Rev 1
5. Exploit
o A specific attack technique that takes advantage of a vulnerability to gain
unauthorized access or disrupt system operations.
o Example: SQL injection, buffer overflow attacks.
6. Zero-Day (0-Day) Attack
o A previously unknown vulnerability in a system or application without a
known fix or patch.
o Attackers exploit it before the vendor becomes aware or can develop a fix.
7. Intrusion
o An event where an intruder gains (or attempts to gain) unauthorized access to
a system or resource.
o Reference: IETF RFC 4949 Ver 2
8. Breach
o A confirmed security incident where unauthorized individuals gain access to
sensitive data.
o Example: A hacker steals customer records from a company database.
o Reference: NIST SP 800-53 Rev. 5
Incident Response Role

Security professionals act as first responders when incidents occur. Their goal is to detect,
contain, and mitigate threats before they escalate into severe breaches. Understanding these
key terms helps organizations categorize incidents and apply appropriate response measures.

The Goal of Incident Response

Organizations must be prepared for security incidents despite their best
efforts to prevent, detect, and mitigate risks. A well-defined Incident
Response Plan (IRP) is essential to minimizing the impact of incidents
and ensuring business continuity.

Understanding Incidents

 An event is any measurable occurrence within a system or network.

Most events are harmless (e.g., a user logging in).

 An incident is an event that disrupts or threatens the organization's

business objectives, requiring a structured response to minimize
damage.

Why Incident Response is Critical

1. Minimizing Disruptions

o Rapid identification and containment of security threats

prevent widespread damage and downtime.

o The goal is to restore normal operations as quickly and

efficiently as possible.

2. Business Continuity Management (BCM)

o Incident response is a key subset of BCM, ensuring that

critical systems remain operational during and after an
incident.

3. Crisis Management

o Some organizations refer to this process as crisis

management, emphasizing the need for a coordinated and
strategic approach.

4. Safety as the Top Priority

 o The first priority in any incident response is life, health,
and safety.

o When making decisions during an incident, safety must

always come first.

Incident Response Plan (IRP) Essentials

A robust IRP should include:

✅ Preparation – Policies, training, and response planning.
✅ Detection & Analysis – Identifying and assessing threats.
✅ Containment – Stopping the spread of the attack.
✅ Eradication & Recovery – Removing threats and restoring systems.
✅ Lessons Learned – Post-incident analysis for improvement.

Components of a Business Continuity

Plan (BCP)
Business Continuity Planning (BCP) involves creating procedures to
restore business operations after a disaster or significant disruption.
It is a business-driven function that aligns technology, security, and
operations to maintain the confidentiality, integrity, and availability
(CIA) of information and systems.

Key Components of a BCP

1️⃣ BCP Team & Contact Information

 List of BCP team members with multiple contact methods.

 Backup team members in case primary personnel are unavailable.

2️⃣ Management Guidelines

 Clear authority designation for managers handling the response.

 Roles and responsibilities of key personnel in decision-making.

3️⃣ External Contacts & Supply Chain Coordination

 Contact numbers for critical vendors, customers, emergency

services, and third-party partners.

 Ensuring external dependencies are accounted for in the recovery

process.

4️⃣ Plan Activation Criteria

  Triggers that define when to enact the BCP.

 Who makes the decision and how to communicate activation.

5️⃣ Immediate Response Procedures

 Checklists for emergency actions (e.g., fire suppression,

evacuation, security procedures).

 Steps for notifying authorities and emergency responders.

6️⃣ Notification & Communication Systems

 Call trees and alerting mechanisms to inform personnel of BCP

activation.

 Methods to maintain real-time communication during a crisis.

Business Continuity in Action: Key

Takeaways from the Scenario
This example illustrates how Business Continuity Planning (BCP)
helps an organization respond effectively to a disruption. Let's break it
down step by step:

1️⃣ Business Impact Analysis (BIA) Prepares for Disruptions

 A Business Impact Analysis (BIA) was conducted four months

prior, identifying the billing department as important but not
immediately critical.

 The BIA helps determine acceptable downtime, dependencies, and

recovery priorities.

2️⃣ Pre-planned Alternative Work Arrangements

 The company had a pre-signed agreement for an alternative work

location, ensuring business operations could resume within a
week.

 The ability to relocate quickly minimizes downtime and revenue

loss.

3️⃣ Temporary Workaround to Maintain Customer Service

 Customer service staff temporarily handled billing inquiries,

preventing a complete breakdown of operations.
  This ensured continued customer support despite the loss of the
billing office.

4️⃣ Financial Resilience & Risk Management

 The company had ample cash reserves, allowing it to absorb a

short-term revenue delay without significant financial distress.

 Risk assessments should include financial buffers to handle

disruptions effectively.

5️⃣ Seamless Execution of the Business Continuity Plan (BCP)

 Pre-planning paid off: No major business disruptions occurred.

 Key business functions continued, and operations smoothly

transitioned to the alternative location.

 The company successfully implemented its BCP, proving the

value of proactive preparedness and response strategies.

💡 What Business Continuity Looks Like in Action:

✅ Minimal Disruption – Even though the billing office was lost, critical
operations continued.
✅ Planned Response – The alternative site and backup plans were
already in place.
✅ Effective Communication – Employees, customers, and stakeholders
were informed and operations transitioned smoothly.
✅ Financial Stability – Having a financial cushion allowed the company
to absorb the temporary delay.

This scenario highlights the importance of BCP in maintaining

business operations, reducing risks, and ensuring resilience in the
face of unexpected disasters.

Key Components of an Incident

Response Plan (IRP)
An Incident Response Plan (IRP) is a structured approach to
detecting, responding to, and recovering from security incidents.
It is guided by the organization's vision, strategy, and mission to
ensure a coordinated and effective response.

🔹 Core Components of an IRP

1️⃣ Policy & Management Approval

✔ Develop a formal policy that aligns with business objectives.

✔ Ensure management approval and support for enforcement.

2️⃣ Identifying Critical Systems & Single Points of Failure

✔ Determine which assets and systems are crucial for operations.

✔ Identify potential single points of failure that could cause major
disruptions.

3️⃣ Incident Response Team & Roles

✔ Establish an Incident Response Team (IRT) with clear roles and

responsibilities.
✔ Train all relevant employees on their incident response duties.

4️⃣ Incident Identification & Initial Response

✔ Ensure early detection and rapid response mechanisms are in

place.
✔ Train staff on how to recognize and report potential incidents.

5️⃣ Communication & Stakeholder Coordination

✔ Define internal and external communication protocols.

✔ Consider alternative communication channels if primary methods
fail.

6️⃣ Evidence Collection & Containment Strategy

✔ Gather evidence while ensuring chain-of-custody procedures.

✔ Choose an appropriate containment strategy to prevent further
damage.
✔ Identify and isolate the attacker to minimize impact.

7️⃣ Incident Analysis & Threat Intelligence

✔ Analyze known data and attack vectors.

✔ Use threat intelligence to understand attack patterns and indicators
of compromise (IoCs).

8️⃣ Prioritization & Standardized Documentation

✔ Rank incidents by severity to allocate resources efficiently.

✔ Maintain consistent documentation for incident tracking and
reporting.

9️⃣ Post-Incident Review & Lessons Learned

✔ Conduct a retrospective to analyze the response effectiveness.

✔ Improve the IRP by documenting lessons learned.
🔹 Phases of Incident Response

1️⃣ Preparation – Develop and train staff on IR procedures.

2️⃣ Detection & Analysis – Identify, classify, and assess incidents.
3️⃣ Containment, Eradication & Recovery – Limit damage, remove
threats, and restore services.
4️⃣ Post-Incident Activity – Review response efforts, document lessons,
and improve strategies.

💡 Why This Matters:

A well-structured Incident Response Plan helps organizations minimize

downtime, reduce damage, and enhance cybersecurity resilience.

🎯 Goal of Disaster Recovery (DR)

Disaster Recovery (DR) focuses on restoring IT and communication
systems following a disaster or major disruption. It ensures the
organization can regain critical technology functions necessary for
business continuity and long-term survival.

🔹 Key Differences: Business Continuity vs. Disaster Recovery

Aspec
Business Continuity (BC) Disaster Recovery (DR)
t

Maintaining critical business Restoring IT & communication

Focus
functions systems

Timin During an incident to ensure After an incident to restore full

g continued operations services

Broad (includes people, Primarily IT infrastructure, data,

Scope
processes, and facilities) and networks

Minimize downtime & ensure Restore IT services to pre-

Goal
business survival disaster state

🔹 Disaster Recovery Planning (DRP) Process

1️⃣ Risk Assessment & Business Impact Analysis (BIA)

✔ Identify potential threats and vulnerabilities.
✔ Determine critical IT systems and acceptable recovery time
objectives (RTOs).

2️⃣ Develop & Document the DR Plan

✔ Outline roles and responsibilities.
✔ Define IT recovery procedures, including server, database, and
network restoration.

3️⃣ Backup & Data Protection Strategies

✔ Implement offsite and cloud backups.
✔ Use redundant systems to minimize downtime.

4️⃣ Establish Alternate IT Infrastructure

✔ Set up hot, warm, or cold sites for failover.
✔ Define a failover and failback strategy for critical applications.

5️⃣ Test & Update the DR Plan

✔ Conduct regular DR drills and simulations.
✔ Continuously update based on lessons learned from incidents.

🔹 Why Disaster Recovery Matters

✅ Minimizes downtime and financial losses.

✅ Ensures compliance with industry regulations.
✅ Protects critical data from loss or corruption.
✅ Enhances organizational resilience against cyber threats and
natural disasters.

🔹 Bottom Line: A Disaster Recovery Plan (DRP) picks up where

Business Continuity (BCP) leaves off, ensuring full restoration of IT
services and long-term stability.

Components of a Disaster Recovery

Plan
A Disaster Recovery Plan (DRP) consists of several key components,
each tailored to specific roles within the organization. Here’s a breakdown
of the different types of DRP documents and their purpose:

1. Executive Summary

 A high-level overview of the plan for executives and

management

 Outlines the scope, objectives, and key recovery strategies

2. Technical Guides

 Detailed documentation for IT personnel

 Includes instructions for restoring critical systems, data, and

network infrastructure

3. Full DR Plan Copies

 Provided to critical disaster recovery team members

 Contains comprehensive procedures for responding to and

recovering from disasters

4. Department-Specific Plans

 Tailored recovery procedures for individual business units

 Ensures that each department can resume operations as quickly as

possible

5. Checklists for Key Personnel

 Disaster Recovery Team Members: Step-by-step actions to

execute the plan

 IT Staff: Instructions for activating backup sites and restoring

services

 Managers & PR Teams: Clear, simplified communication

strategies

These documents collectively help ensure a structured, efficient

recovery process in case of a disaster.

The Importance of Business Continuity

A Business Continuity Plan (BCP) ensures that an organization can
sustain operations despite disruptions such as cyberattacks, natural
disasters, or system failures.

Key Aspects of Business Continuity

1. Communication is Critical 📞

o Multiple contact methods should be in place

o Backup numbers for essential personnel and suppliers

o Emergency communication strategies in case of power or

network failures

2. Immediate Activation of the BCP 🚨

 o Notify key personnel and decision-makers

o Ensure management involvement to prioritize responses

o Execute shutdown procedures for critical systems if required

3. Maintaining the Supply Chain & External Contacts 🏢

o Keep law enforcement and external partners informed

o Ensure emergency contacts for critical infrastructure

(e.g., hospitals)

o Use alternative communication methods if necessary (such as

military-grade networks)

4. Predefined Response Structure 📋

o Establish a phone tree for redundancy in communication

o Ensure clear roles and responsibilities for incident

response

o Follow checklists and procedures to prevent critical steps

from being overlooked

Just like pilots follow a pre-flight checklist before takeoff, businesses

must systematically follow business continuity procedures to avoid
mistakes during a crisis.

Disaster Recovery in the Real World

Key Concepts

 Critical System Identification: Organizations must identify critical

systems and ensure they have tested backups.

 Delayed Incident Detection: Some incidents may go unnoticed

for days or months, making timely response difficult.

 Complex System Dependencies: Data often flows between

multiple interconnected systems, requiring detailed recovery
planning.

Examples of Disaster Recovery in Action

1. Enterprise-Level Data Recovery

 Large enterprises distribute data across multiple systems and

databases.
  When recovering from a disaster, it is not enough to restore
server backups—the database and interdependent systems
must also be restored.

 Understanding data flow and dependencies is crucial for a

successful recovery plan.

2. Hospital Cyberattack Case Study

 Separate Systems: Radiology and laboratory departments used

different databases, with patient data copied across systems.

 Malware Infection: A time-based malware attack corrupted

backups, making recent backups useless.

 Extended Recovery Process:

o The hospital had to restore data from nearly a year prior

to prevent reinfection.

o Data was restored piece-by-piece to avoid spreading

malware.

 Key Lessons:

o Importance of long-term retention of backups.

o Need for layered backup strategies to prevent widespread

corruption.

3. Los Angeles Hospital Incident

 Time to Detect Compromise: 260 days (8.5 months) before

discovering the incident.

 Key Takeaway: Early detection and response mechanisms are

critical to minimizing damage.

Best Practices for Disaster Recovery

✅ Regularly test backups to ensure they are functional and malware-

free.
✅ Understand data dependencies between different systems before
recovery.
✅ Maintain multiple backup versions with long-term retention.
✅ Implement monitoring tools to detect threats early.
✅ Have a step-by-step recovery plan to avoid reinfection.
Conclusion

Disaster recovery is more than just restoring data—it requires strategic

planning, threat monitoring, and understanding system
dependencies. Real-world examples show that early detection, proper
backup retention, and systematic recovery processes are critical for
success.

Incident Response Team (IRT)

1. Purpose of an Incident Response Team

 A properly staffed and trained IRT helps in identifying and

mitigating security incidents.

 IT professionals act as first responders, differentiating between IT

issues and security incidents.

 The team ensures quick investigation, containment, and

recovery from cyber incidents.

2. Members of an Incident Response Team

A cross-functional group including:

✅ Senior management – Decision-making authority
✅ Information security professionals – Technical experts for security
measures
✅ Legal representatives – Handle compliance and legal aspects
✅ Public affairs/communications – Manage public relations
✅ Engineering (System/Network) – Assess system and network
vulnerabilities

3. Responsibilities of an Incident Response Team

🔹 Detection & Damage Assessment – Identify and measure the scope

of damage.
🔹 Confidentiality Check – Determine if sensitive information was
compromised.
🔹 Recovery & Restoration – Implement measures to restore operations.
🔹 Security Improvements – Ensure security enhancements to prevent
recurrence.

4. Dedicated Incident Response Teams

 Many organizations establish Computer Incident Response

Teams (CIRTs) or Computer Security Incident Response
Teams (CSIRTs).
  These teams handle security breaches, coordinate responses, and
improve security frameworks.

Domain 3: Access Control Concepts

What is Security Control?
A security control is a safeguard or countermeasure designed to
preserve the Confidentiality, Integrity, and Availability (CIA Triad)
of data.

Types of Security Controls:

1. Preventive Controls – Stop security incidents before they occur.

o Example: Firewalls, Access Control Lists (ACLs), Encryption.

2. Detective Controls – Identify security incidents when they happen.

o Example: Intrusion Detection Systems (IDS), Security Audits,

Log Monitoring.

3. Corrective Controls – Restore systems after a security incident.

o Example: Backups, Patch Management, Disaster Recovery

Plans.

Example: Firewall as a Security Control

 Blocks unauthorized access from external threats.

 Prevents data leaks by restricting outgoing traffic.

 Implements access rules to allow only authorized

communication.

Key Takeaway:

Security controls protect IT environments by regulating who can

access what, under what conditions, and how to respond to
security threats.

Access Control Overview

Access controls are the core of an information security program.
They determine:

 Who can access organizational assets (buildings, data, systems,

etc.).
  What they can do once they have access.

Access control is not just about restricting access; it also involves

granting the appropriate level of access to authorized individuals or
processes.

Key Elements of Access Control

1. Subjects (Active Entities)

A subject is any entity that requests access to an asset.

 Examples: Users, clients, processes, programs, devices (e.g., workstations,

smartphones, storage devices).
 Active Role: Subjects initiate a request for access or services.
 Access Level: Subjects should have clearance or permissions defining what they can
access.

2. Objects (Passive Entities)

An object is any asset that a subject attempts to access.

 Examples: Files, databases, servers, printers, network resources, buildings,

memory blocks.
 Passive Role: Objects do not initiate actions; they respond when accessed.
 Ownership: Every object has an owner, who defines who or what can access it.

3. Rules (Access Policies)

Rules define how access is granted or denied by comparing the subject's identity to an Access
Control List (ACL).

 Examples of Rules:
o Firewall access control lists (ACLs)
o File permissions (read, write, execute)
o Time-based access control (e.g., access allowed only during work hours)
 Access Rule Functions:
o Allow or deny access to an object
o Define level of access (read-only, modify, full control)
o Compare attributes (role-based access, location, time)

Summary: The Three Core Elements of Access Control

Element Definition Example
Subjects Active entities requesting access User logging into a system
Objects Passive entities being accessed Database, file, printer
Rules Policies governing access permissions Firewall rule allowing web access

Key Takeaway:

Access control is about ensuring the right people, processes, and systems have the
appropriate access while preventing unauthorized access.

Control Assessments & Risk Reduction

Effective risk reduction depends on how well security controls adapt
to the current and changing environment. A well-planned assessment
ensures that controls are appropriate, cost-effective, and aligned
with security needs.

Scenario: Securing a Physical Location

Imagine an office space being repurposed as a secure storage

facility for confidential files.

 The space has five doors that need to be secured before storing
sensitive information.

 The right security measures must be implemented based on an

assessment.

Key Considerations for Physical Security

1. Site Assessment
 o Determine if all five doors need high-security locks.

o Identify whether some doors can be permanently sealed or

removed.

2. Security Controls Based on Risk & Budget

o High Security: Install biometric scanners on all doors for

strict access control.

o Balanced Approach: Use biometric scanners on key

doors and permanently secure others.

o Cost-Effective Option: Use deadbolt locks if extensive

access control is not required.

3. Cost vs. Security Value

o The cost of security controls must align with the value of

the protected assets.

o Over-engineering security wastes resources, while under-

securing assets introduces risk.

Key Takeaways

✔ Controls should be tailored to the security requirements.

✔ Risk assessments help determine the necessary level of security.
✔ Cost-effective solutions can sometimes provide adequate protection.
✔ Physical security is just as critical as digital security when
protecting sensitive information.

Defense in Depth: A Layered Security

Approach
Defense in Depth is a multi-layered security strategy designed to
protect an organization's assets by integrating people, technology, and
operations. The goal is to establish multiple barriers to slow down or
deter potential attackers.

Key Concepts of Defense in Depth

🔹 Multiple Security Layers
Security controls are stacked across multiple layers, making it difficult
for attackers to bypass all defenses.

🔹 Combination of Controls
Security is not just about technology—it also involves administrative,
technical, and physical measures.

🔹 Risk Reduction, Not Elimination

While defense in depth improves security, no system is 100% secure.
The goal is to increase complexity for attackers and reduce impact.

Examples of Defense in Depth

Technical Example: Multi-Factor Authentication (MFA)

A username and password alone can be compromised. By requiring a

one-time code on a phone, attackers must bypass two layers of
authentication:
✔ Something You Know → Password
✔ Something You Have → Mobile device for OTP

Network Security Example: Firewalls & Segmentation

Organizations separate networks based on sensitivity levels:

✔ Firewall 1 → Protects from the internet (untrusted network).
✔ Firewall 2 → Protects internal resources from external access.
✔ Firewall 3 → Protects the most sensitive data (e.g., financial or
customer records).

Physical Security Example: Data Center Access

✔ Layer 1 (Physical Control): A locked door restricting entry.

✔ Layer 2 (Technical Control): Network access restrictions to sensitive
data.
✔ Layer 3 (Administrative Control): Company policies restricting
access to authorized personnel.
Types of Security Controls in Defense in Depth

Security Layer Description Example

Administrative Policies & procedures that guide Security policies,

Controls security implementation user training

Logical/Technical Technology-based controls to Firewalls, MFA,

Controls enforce security encryption

Protects physical access to Locks, security

Physical Controls
assets guards, cameras

Key Takeaways

✔ Layered security prevents a single point of failure.

✔ Combining physical, administrative, and technical controls
increases protection.
✔ No single security measure is enough—organizations need a multi-
layered approach.

Examples of the Principle of Least

Privilege (PoLP)
The Principle of Least Privilege (PoLP) is a security best practice
ensuring that users, applications, and processes only have the
minimum level of access necessary to perform their tasks.

Why Least Privilege Matters

✔ Reduces risk of data breaches → Limits access to sensitive data.

✔ Protects confidentiality & integrity → Prevents unauthorized
changes.
✔ Minimizes impact of compromised accounts → Attackers cannot
access everything.

Real-World Examples of Least Privilege

🔹 Billing Department Access Control

 Employees in billing can view financial data.

 Only managers can edit or delete financial records.

🔹 Time-Based & Temporary Access

 Contractors or auditors only receive access for a limited time

period.

 Employees can only access systems during business hours.

🔹 Healthcare Data Access Restrictions

 Nurses can access patient records, but not billing data.

 Doctors can only see medical records for their assigned

patients.

 Systems comply with HIPAA and other privacy regulations.

🔹 Privileged Account Monitoring

 Admin accounts are only used for specific tasks (e.g., system
updates).

 Logs track unauthorized access attempts, triggering security

alerts.

Enhancing Least Privilege with Security Measures

Security Control Purpose Example

Multi-Factor
Adds extra security to Bank & IT admin logins
Authentication
critical accounts require MFA
(MFA)

Role-Based Access Grants permissions HR staff cannot access

Control (RBAC) based on job role financial data

Just-in-Time (JIT) Temporary access for A user gets access to a

Access a task server for 1 hour

Access Logging & Tracks & alerts on Security team is alerted for
Monitoring unauthorized access suspicious login attempts

Key Takeaways

✔ Limit access to what is necessary for the job role.

✔ Use time-based & temporary permissions when needed.
✔ Monitor access logs to detect unauthorized attempts.
✔ Require MFA for high-privilege accounts.

Importance of Privileged Access

Management (PAM)
Privileged Access Management (PAM) is a security strategy designed to
control, monitor, and limit administrative access to prevent cyber threats
such as ransomware attacks, insider threats, and accidental damage.

Lessons from ABC, Inc. Scenario:

🔹 Overprivileged Accounts Create Security Risks

✔ IT staff added their accounts to the Domain Admins group,
granting them full access to the Windows environment.
✔ A phishing email with a malicious attachment compromised their
account, leading to a ransomware attack.

🔹 Static Privileges Increase Risk

✔ Without PAM, admin accounts have always-on access, making them
high-value targets.
✔ The ransomware exploited their privileges to encrypt files across all
systems.
🔹 Just-in-Time (JIT) Privileged Access Reduces Risk
✔ PAM enforces role-based access, granting temporary administrative
privileges only when needed.
✔ Routine tasks (e.g., email access) are performed without elevated
privileges.
✔ High-risk actions require explicit approval and time-limited access.

How PAM Enhances Security:

✅ Reduces Attack Surface → Admin privileges are only active when

needed.
✅ Limits Ransomware Spread → Malware cannot exploit always-on
admin rights.
✅ Prevents Insider Threats → Restricts unnecessary access to critical
systems.
✅ Ensures Compliance → Meets security standards like NIST, ISO
27001, PCI-DSS.

By implementing Privileged Access Management, organizations can

minimize security risks, prevent unauthorized access, and
maintain control over privileged accounts.

Understanding Privileged Accounts & Access

Management
What are Privileged Accounts?

Privileged accounts have higher permissions than regular user accounts and are critical for
managing IT environments. These accounts can belong to:

 System Administrators → Manage OS, application deployment, and performance.

 Help Desk/IT Support → Reset passwords, unlock accounts, and troubleshoot.
 Security Analysts → Require access to infrastructure, endpoints, and data for threat
detection.

Security Risks & Management Strategies for Privileged Accounts

1️⃣ Extensive Logging & Monitoring

✔ Logs deter misuse by privileged users.
✔ Privileged actions should be audited regularly to detect anomalies.
2️⃣ Stringent Access Controls
✔ Multi-Factor Authentication (MFA) → Ensures only authorized users gain access.
✔ Just-in-Time (JIT) Privileges → Limits access to specific tasks & times.

3️⃣ Trust Verification & Vetting

✔ Background checks for privileged users.
✔ Strict NDAs and financial background investigations (if needed).

4️⃣ Granular Role-Based Access (RBAC)

✔ Assign privileges only for required tasks (e.g., Help Desk resetting passwords without
domain admin rights).
✔ Separation of Duties (SoD) → Prevents a single user from having unchecked control over
critical operations.

Example: Help Desk Privileged Access Management

✔ Help Desk must reset passwords & unlock accounts.

✔ Instead of giving Domain Admin access, assign only password reset/unlock privileges.
✔ Automatically log and audit password resets by comparing with user requests.

🔹 Outcome? Help Desk can solve issues quickly without compromising security.

Implementing Privileged Access Management (PAM) helps reduce risk, enforce least
privilege, and strengthen security across the organization.

Separation of Duties & Security

Controls
Separation of Duties (SoD), also known as Segregation of Duties, is a
security principle that ensures no single individual has complete control
over high-risk transactions. This reduces the risk of fraud, errors, and
unauthorized actions.

Key Principles of SoD

🔹 Dividing Responsibilities
✔ Critical tasks are broken into multiple steps.
✔ Different individuals execute each step.

🔹 Preventing Fraud & Errors

✔ Ensures checks and balances in financial transactions, system
changes, and access control.
✔ Example: An employee submits an invoice, but a manager must
approve it before payment.
🔹 Collusion Risk
✔ If two individuals intentionally bypass SoD, it’s called collusion.
✔ Regular audits help detect and prevent such actions.

Implementation of Separation of Duties

✅ Dual Control
✔ Requires two separate individuals to complete a task.
✔ Example: A bank vault has two different combination locks,
requiring two employees to unlock it together.

✅ Two-Person Integrity Rule

✔ A high-security area requires at least two people to be present.
✔ Prevents insider threats and ensures safety in case of
emergencies.

✅ Access Control Mechanisms

✔ Security systems can enforce dual authorization for high-risk actions.
✔ Example: A system update requires approval from both technical and
managerial personnel.

Key Takeaway:

Separation of Duties reduces risk, prevents fraud, and enhances

security by ensuring no single individual has excessive control
over critical processes.

Authorized vs. Unauthorized Personnel

& User Provisioning
🔹 Authentication vs. Authorization
✔ Authentication: Confirms a user's identity (e.g., login credentials,
biometric scan).
✔ Authorization: Grants or denies access based on the user’s role and
permissions.

💡 Example:

 An employee swipes their ID badge at the data center door.

 The system authenticates the badge.

 It checks the security matrix for authorization.

 If authorized, the door unlocks; if not, access is denied.

User Provisioning & Access Management

✅ 1. New Employee Onboarding

✔ The hiring manager requests a new user ID.
✔ Security admins approve & assign access levels.
✔ Elevated privileges require additional authorization.

✅ 2. Change of Position
✔ Employee promotion or role change requires updating access.
✔ New privileges granted, outdated access removed.
✔ Prevents privilege creep (accumulating unnecessary access).

✅ 3. Separation of Employment
✔ Upon termination, accounts must be disabled immediately.
✔ Accounts should remain inactive for a period before deletion for
auditing purposes.
✔ Prevents former employees from accessing company data.

Best Practices for User Access Management

🔹 Avoid Copying User Profiles

✔ Copying permissions from an existing user can lead to excessive
access rights.
✔ Instead, use standardized roles for provisioning access.

🔹 Enforce Role-Based Access Control (RBAC)

✔ Assign access based on job function.
✔ Prevents unauthorized privilege accumulation.

🔹 Regular Access Reviews & Audits

✔ Periodically review user access to remove unnecessary permissions.
✔ Ensure only authorized personnel can access sensitive resources.

Key Takeaway 🚀

Effective user provisioning and strict access controls ensure that only
authorized personnel have the right level of access—reducing
security risks and preventing unauthorized data exposure.

Physical Security Controls

🔹 What Are Physical Security Controls?
Physical security controls are tangible mechanisms used to prevent,
monitor, or detect unauthorized access to a physical site (e.g.,
workplace, data center).

🔹 Examples of Physical Security Controls

✅ Preventive Controls (Block Unauthorized Access)

✔ Security guards
✔ Fences & locked doors/gates
✔ Sealed windows & cable protection
✔ Laptop locks & swipe cards
✔ Mantraps & turnstiles

✅ Detective Controls (Identify Intrusions)

✔ Motion detectors & surveillance cameras
✔ Alarm systems
✔ Guard dogs

✅ Corrective Controls (Respond to Security Incidents)

✔ Security response teams
✔ Emergency lighting & backup power
✔ Fire suppression systems

🔹 Why Are Physical Security Controls Important?

🔹 Protect People & Assets

✔ Ensures employee safety from unauthorized access or threats.
✔ Prevents theft or damage to company assets (computers, data
servers).

🔹 Prevent Cybersecurity Breaches

✔ A stolen server or hard drive can lead to data leaks.
✔ Prevents social engineering attacks (e.g., tailgating into restricted
areas).

🔹 Regulatory Compliance
✔ Many industries require physical security (e.g., HIPAA, ISO 27001, PCI-
DSS).

🔹 Business Continuity
✔ Physical controls ensure continuous operations by preventing
disruptions.

🔹 Key Takeaway 🚀
Physical security controls prevent unauthorized access, protect
personnel, and secure assets—acting as the first line of defense in
an organization’s security strategy.

Types of Physical Access Controls

Physical access control mechanisms restrict, monitor, and manage
access to facilities. They range from deterrents to detection mechanisms
and must be tailored to different areas, such as perimeter security and
internal zones.

🔹 Key Physical Access Control Mechanisms

1️⃣ Entry Control Technologies

🔹 Turnstiles & Mantraps – Prevent unauthorized tailgating into secured

areas.
🔹 Door Locks (Manual & System-Controlled) – Controlled through
badges, keypads, or biometrics.

2️⃣ Authentication Methods

🔹 Badge Systems & Smart Cards – Used for gate entry and tracked by
access control logs.
🔹 Biometric Systems – Use unique physiological or behavioral
traits for authentication.

Biometric
Examples
Type

Physiologic Fingerprint, iris scan, retina scan, palm scan, vein

al scan

Voice recognition, signature dynamics, keystroke

Behavioral
dynamics

🔹 Biometric Enrollment Process

✔ Enrollment – User’s biometric data is stored in the system or a smart
card.
✔ Verification – User’s biometric data is compared with stored records.

3️⃣ Crime Prevention through Environmental Design (CPTED)

🔹 Uses architectural and circulation flow design to deter crime.
🔹 Incorporates natural surveillance, clear access paths, and visibility
enhancements.

4️⃣ Access Cards & Credentials

Different types of access cards enable security across varied

environments:

✅ Bar Code – Low-cost but easy to duplicate.

✅ Proximity Card – Uses RFID for contactless access.
✅ Hybrid Card – Combines multiple technologies.
✅ Magnetic Stripe – Swiped for access but wears out over time.
✅ Smart Card – Embedded chip for high security and multi-factor
authentication.

🔹 Challenges & Considerations

❌ Biometric Privacy Concerns – Users worry about personal data

exposure.
❌ Hygiene Issues – Touch-based scanners require frequent sanitization.
❌ Costly Implementation – High-accuracy biometric systems require
significant investment.
❌ Medical Data Risks – Retina scans may reveal medical conditions.

🔹 Summary 🚀

Physical access controls prevent unauthorized entry and enhance

security through a combination of technology, design, and
authentication mechanisms. While biometrics offer high security,
organizations must balance cost, privacy, and usability.

What are Logical Access Controls?

While physical access controls restrict entry to a physical location,

logical access controls are electronic methods that regulate access
to systems, data, or digital assets—even for individuals who have
already gained physical access.

1️⃣ Types of Logical Access Controls

🔹 Passwords – The most common authentication method, requiring

strong and unique combinations.
🔹 Biometrics – Used on devices like smartphones and laptops (e.g.,
fingerprint or face recognition).
🔹 Badge/Token Readers – Connected to IT systems for additional
verification beyond physical access.

2️⃣ Purpose of Logical Access Controls

✅ Prevent unauthorized digital access, even if physical access is

gained.
✅ Protect sensitive information from being viewed, modified, or stolen.
✅ Layered security – Works alongside physical controls for enhanced
protection.

Logical access controls are a critical part of cybersecurity, ensuring

that only authorized users can access specific systems or data—even if
they are inside a secured building

Discretionary Access Control (DAC) 🔐

Discretionary Access Control (DAC) is a flexible access control
model where the owner of an asset (file, folder, or system) determines
who can access it and what permissions they have.

1️⃣ Key Features of DAC

✔ User-Controlled Access – The asset owner decides access

permissions.
✔ Permission Delegation – Users can grant or revoke access.
✔ Flexible but Risky – Security depends on user discretion, which may
lead to unauthorized access.

2️⃣ Example of DAC in Action 📂

Imagine Steve and Aidan working in a UNIX system:

📌 Aidan owns "Excel File 1"
📌 Steve owns "Excel File 2"
📌 Aidan grants Read | Write | Execute access to himself, but only Read
access to Steve.

This system uses Access Control Lists (ACLs) or Capability Lists to

track permissions.
3️⃣ Where is DAC Used?

✅ File-sharing platforms (Google Drive, OneDrive) – You decide who can

view/edit files.
✅ Operating systems (Windows, Linux, macOS) – Users control file
permissions.
✅ Office security – Temporary visitor badges issued at the discretion of
the security desk.

4️⃣ Limitations of DAC ⚠

❌ Not Scalable – Difficult to manage large user groups.

❌ Risk of Privilege Escalation – A user may accidentally or
intentionally share sensitive data.
❌ Difficult to Audit – Tracking permission changes across multiple
objects can be complex.

🔹 Key Takeaway: While DAC offers flexibility, it requires careful

management to prevent unauthorized access and security risks!

Mandatory Access Control (MAC)

Mandatory Access Control (MAC) is a strict access control model
where only security administrators can define and enforce access
policies.

1️⃣ Key Features of MAC

✅ Centralized Control – Only trusted security administrators can

modify access rules.
✅ No User Discretion – Users cannot share, modify, or grant
permissions.
✅ Strict Policy Enforcement – Access is based on predefined
classifications (e.g., Top Secret, Confidential).
✅ Used in High-Security Environments – Common in military,
government, and critical infrastructure.

2️⃣ MAC vs. DAC – What’s the Difference?

MAC (Mandatory Access DAC (Discretionary

Feature
Control) Access Control)

Who Security Administrator Object Owner (User)

 MAC (Mandatory Access DAC (Discretionary
Feature
Control) Access Control)

controls
access?

Rigid – Users cannot modify Flexible – Users can modify

Flexibility
access and share

Highly secure
Best used General use (e.g., File
environments (e.g., Military,
for sharing, Workplaces)
Government)

Classified government files A Google Drive file where

Example
(Top Secret, Confidential) the owner sets permissions

3️⃣ How MAC Works in Real Life

🔐 Military & Government Security – Classified documents marked Top

Secret can only be accessed by authorized personnel.

🔒 Banking & Healthcare Systems – Patient records in hospitals are

restricted based on roles and clearance levels.

4️⃣ Why Use MAC?

✅ Pros:
✔️Stronger security – Prevents accidental or intentional data leaks.
✔️Prevents privilege escalation – Users cannot grant access they
don’t have.

❌ Cons:
⏳ Less flexibility – Slower access modifications since only admins can
change them.
⚙️Complex management – Requires careful planning and strict
classification policies.

5️⃣ Conclusion

MAC is more secure than DAC but is also less flexible. Organizations
with high-security needs (e.g., military, finance, healthcare) often
combine MAC with Role-Based Access Control (RBAC) for better
efficiency and security.
Mandatory Access Control (MAC) in the
Workplace
🔹 MAC is a strict access control model where permissions are
enforced uniformly, and individual users cannot make changes to
access rights. It is typically used in government, military, and high-
security workplaces.

🔑 Key Characteristics of MAC in Workplaces

✅ Access is Assigned Based on Security Policies – Not based on

personal judgment.
✅ Requires Clearance Levels – Employees must have the necessary
security clearance to access certain areas or data.
✅ Enforced by System Administrators – Only trusted security
admins can modify permissions.
✅ Supports Separation of Duties (SoD) – Prevents users from
accessing unnecessary information.
✅ Often Works with Role-Based Access Control (RBAC) – Assigns
access based on job roles.

🏢 MAC Workplace Examples

1️⃣ Government Agencies & Military

 Employees must have proper clearance (e.g., Top Secret,

Confidential) to access sensitive data.

2️⃣ Financial Institutions (Banks, Investment Firms)

 Bank tellers cannot access customer investment portfolios, and

investment managers cannot process transactions.

3️⃣ Healthcare Facilities

 Doctors can access patient medical records, but hospital admin

staff cannot modify them.

4️⃣ Corporate Security Systems

 Employees cannot access HR salary data unless explicitly

authorized.

📌 Why Use MAC in Workplaces?

✅ High Security – Prevents unauthorized access to sensitive data.
✅ Prevents Insider Threats – No user can modify access levels
arbitrarily.
✅ Reduces Risk of Human Error – Access is strictly predefined.

❌ Challenges:
⏳ Slower access management – Changes require admin intervention.
⚙️Less flexibility – Employees cannot grant permissions to colleagues.

🔍 Conclusion

MAC ensures that access permissions remain strictly controlled,

making it ideal for high-security workplaces where confidentiality and
data protection are critical.

Role-Based Access Control (RBAC) in

the Workplace
🔹 RBAC assigns permissions based on job roles rather than individual
users. It ensures employees only have the access necessary to perform
their duties, improving security and efficiency.

🔑 Key Characteristics of RBAC

✅ Permissions Assigned by Role, Not by User – Employees get

predefined access based on their position.
✅ Least Privilege Principle – Users only have minimum access
required for their job.
✅ Prevents Unauthorized Access – Departments only access their own
data (e.g., HR for personnel files, Finance for bank accounts).
✅ Scalability – Adding new users is easier because access is based on
roles rather than assigning permissions individually.
✅ Reduces Administrative Overhead – Fewer manual interventions are
needed to manage access.

🏢 RBAC Workplace Examples

1️⃣ Human Resources (HR)

 HR staff can view and manage employee records, but other

departments cannot.
2️⃣ Finance & Accounting

 Only finance employees can access bank accounts & payroll

systems.

3️⃣ IT System Administrators

 Senior admins have full system access, while helpdesk staff only
get basic troubleshooting rights.

4️⃣ Retail Stores & Customer Service

 Cashiers can process transactions, but only store managers can

approve refunds.

⚠️The Problem of Privilege Creep

🔸 What is Privilege Creep?

 Occurs when an employee’s permissions accumulate over time

due to role changes or temporary access that was never
revoked.

 Example: A junior employee temporarily acts as a manager but

retains higher access even after returning to their previous
role.

🔸 How to Prevent It?

✅ Regular Audits – Review and revoke unnecessary permissions.
✅ Standard Role Templates – Assign roles instead of copying
permissions from other employees.
✅ Access Reviews on Role Changes – Ensure that permissions reset
when someone moves to a new job.

📌 Best Practices for RBAC Implementation

✅ Define Standard Roles Clearly – Avoid excessive granular roles that

are difficult to track.
✅ Implement the Least Privilege Principle – Ensure employees only
get necessary access.
✅ Automate Access Reviews – Regularly audit user access to prevent
privilege creep.
✅ Use a Role Management System – Helps enforce consistent access
control policies.
🔍 Conclusion

RBAC provides a structured approach to access control, ensuring that

employees have the right permissions without unnecessary
access. It simplifies management and reduces security risks caused by
unauthorized access or privilege creep.

Controls and Risks

A control serves to reduce the risk according to where it falls within the
risk tolerance of the individual or organization.

ey Concepts:

1. Physical Controls

o These are tangible measures that directly reduce risk.

o Examples: Wearing a seatbelt, securing a bookshelf with a

bracket.

2. Administrative Controls

o These are policies, laws, or guidelines that enforce safety

practices.

o Examples: Seatbelt laws, building codes requiring

bookshelves to be secured.

3. Risk Mitigation

o Both physical and administrative controls work together to

reduce risks to an acceptable level.

o Risk Tolerance: The level of risk an individual or organization

is willing to accept.

Cybersecurity Perspective:

In cybersecurity, similar principles apply:

 Physical control: Biometric access to a server room.

 Administrative control: A company policy requiring multi-factor

authentication (MFA).
Domain 4: Network Security

What is Networking?
 A network is two or more computers linked together to share data, information, or
resources.
 Types of Networks:
o Local Area Network (LAN): Covers a small geographical area (e.g., a single
floor or building).
o Wide Area Network (WAN): Connects geographically distant networks over
long distances.

2. Network Devices

Hubs

 Basic device used to connect multiple devices.

 Broadcasts data to all connected devices (not intelligent).
 Less common in business environments.

Switches

 Intelligent device that directs data to specific devices.

 More efficient than hubs.
 Supports VLANs (creates separate broadcast domains).

Routers

 Connects different networks and controls traffic flow.

 Determines the most efficient route for data.
 Can be wired or wireless.

Firewalls

 Controls and protects network traffic by filtering data.

 Used between private networks and the internet or between internal network
segments.
 Works based on predefined rules (Access Control Lists - ACLs).

Servers

 Provides services to client devices (e.g., web, email, print, file, and database servers).
 Typically secured more than regular workstations.

Endpoints
  End-user devices like desktops, laptops, tablets, and mobile phones.
 Communicates with servers to access resources.

3. Network Addressing

Media Access Control (MAC) Address

 Unique hardware address assigned to a network device.

 Example: 00-13-02-1F-58-F5 (first 3 bytes indicate the manufacturer).
 No two devices in the same network can have the same MAC address.

Internet Protocol (IP) Address

 Logical address assigned to a device on a network.

 Can be IPv4 (e.g., [Link]) or IPv6 (e.g., 2001:db8::f:0:1).

4. Network Standards

Ethernet (IEEE 802.3)

 Standard defining wired network connections.

 Ensures data formatting consistency across wired networks.

Virtual LAN (VLAN)

 Allows logical segmentation of networks within a switch.

 Improves security and network efficiency.

5. Secure Data Communications

 Involves multiple technologies including hardware, software, encryption, and

protocols.
 Key focus areas:
o Device security (firewalls, access controls).
o Data integrity and encryption.
o Efficient routing and traffic management.

Networking at a Glance
1. Small Business Network Overview

 Uses separate router, firewall, and network switch for better

security and management.
  All devices connect via a network switch, ensuring efficient
wired communication.

 The firewall is placed between the switch and the internet to

filter and protect traffic.

 Common devices in a business network:

o Server – Centralized resource for data and applications.

o Workstations – Desktop computers for employees.

o Printers – Shared network printers.

o Laptops/Tablets/Phones – Used for mobile connectivity.

2. Home Network Overview

 Typically uses a single device (combining router, firewall, switch,

and wireless access point).

 Wireless Access Point (WAP) is often integrated with the router.

  Connects multiple wireless and wired devices like:

o Laptops, Tablets, Phones – Accessing the internet

wirelessly.

o Desktops, Printers – Often wired for stability.

3. Key Differences Between Home and Business Networks

Feature Small Business Network Home Network

Router, Firewall, Separate devices for Usually combined in one

Switch better control device

Higher security with Basic security through ISP-

Security
dedicated firewall provided router

Servers, workstations, Personal laptops, tablets,

Devices
network printers smart devices

Mostly wired with Mostly wireless with basic

Connectivity
managed switches routing
Networking Models
1. Overview
Networking models, architectures, and standards exist to interconnect different hardware and
software systems for:

 Information sharing
 Coordinated activities
 Joint or shared tasks

A network is an integration of multiple components:

✔ Communication devices (Routers, Switches, Hubs)
✔ Storage devices (NAS, SAN)
✔ Processing devices (Servers, Workstations)
✔ Security devices (Firewalls, IDS/IPS)
✔ Input/Output devices (Keyboards, Monitors, Printers)
✔ Operating systems, software, services, and data

2. Key Security & Networking Principles

To translate security needs into a reliable network system, the following principles apply:

 Reliable, managed communication between hosts and users

 Layered architecture to isolate functions
 Packet-based communication for efficiency
 Standardized routing, addressing, and control
 Extendable layers for additional functionalities
 Vendor-agnostic, scalable, and resilient network designs

3. Network Model Structure

A network model typically has two primary layers:

Upper Layer (Host/Application Layer)

 Manages session integrity and communication control

 Establishes, maintains, and terminates sessions between computers
 Transforms data into a format any system can understand
 Ensures applications can communicate and checks availability of remote partners

Lower Layer (Media/Transport Layer)

 Receives raw bits from the physical connection and converts them into frames
 Frames contain grouped bits in standardized sizes for efficient transport
 Adds routing information to create packets (destination addresses)
 Sends packets to the upper layer for processing
4. OSI Model (Layered Approach)
The OSI (Open Systems Interconnection) Model divides networking into seven layers:

Layer No. Layer Name Function

Provides network services to applications (e.g., HTTP, FTP,
7 Application
SMTP)
Translates data formats, encryption, and compression (e.g., SSL,
6 Presentation
JPEG)
Establishes and manages sessions between applications (e.g.,
5 Session
NetBIOS)
4 Transport Ensures reliable data transfer (e.g., TCP, UDP)
3 Network Handles IP addressing and routing (e.g., IP, ICMP)
Defines data frame handling and MAC addresses (e.g., Ethernet,
2 Data Link
MAC)
1 Physical Defines physical connections (e.g., cables, radio signals)

Upper Layers (Application-Oriented)

 Application, Presentation, and Session Layers

 Focus on how software interacts with network communication

Lower Layers (Transport & Media-Oriented)

 Transport, Network, Data Link, and Physical Layers

 Focus on how data moves through the network

Open Systems Interconnection (OSI)

Model
1. Overview

The OSI Model was developed to standardize how computer systems

communicate. It serves as a theoretical framework for understanding
networking, defining seven layers that interact to support data exchange.

✔ Provides a structured reference for networking technologies

✔ Ensures interoperability between different hardware/software
✔ Defines how protocols should ideally function

2. OSI Model Layers & Functions

Layer Layer Example
Function
No. Name Devices/Protocols

7 Application Provides services to applications HTTP, FTP, SMTP

Presentatio Translates data formats,

6 SSL, JPEG, PNG
n encryption, compression

Establishes, manages, and

5 Session NetBIOS, RPC
terminates sessions

Ensures reliable/unreliable
4 Transport TCP, UDP
delivery via segmentation

Handles IP addressing, routing,

3 Network Routers, IP, ICMP
packet forwarding

Frames data, manages MAC Switches, Ethernet,

2 Data Link
addressing MAC

Converts data into binary Cables, Hubs, Radio

1 Physical
signals, handles transmission Signals

✔ Layers 7-5 (Upper Layers) → Handle application-level communication

✔ Layers 4-1 (Lower Layers) → Manage data transportation and
hardware

3. Encapsulation & De-Encapsulation

✔ Encapsulation: As data moves down the OSI model, headers (and

footers) are added at each layer.
✔ De-Encapsulation: As data moves up, headers are stripped off to
retrieve the original data.

Encapsulation Process (Data Flow Downwards)

1. Application Layer creates data

2. Transport Layer adds TCP/UDP header → Creates a Segment

3. Network Layer adds IP header → Creates a Packet

4. Data Link Layer adds MAC address & frame header → Creates a
Frame

5. Physical Layer converts data to bits → Sends as Binary (0s & 1s)

De-Encapsulation Process (Data Flow Upwards)

1. Physical Layer receives bits

2. Data Link Layer extracts frame

 3. Network Layer extracts packet

4. Transport Layer extracts segment

5. Application Layer receives the original data

4. Key Examples

 JPEG, PNG → Presentation Layer (6)

 Routers forwarding packets → Network Layer (3)

 Switches forwarding frames → Data Link Layer (2)

 NetBIOS managing sessions → Session Layer (5)

 TCP/UDP managing transport → Transport Layer (4)

Transmission Control Protocol /

Internet Protocol (TCP/IP)
1. Overview

✔ Developed in the early 1970s – Predates the OSI Model

✔ Most widely used protocol today – Platform-independent & open
standard
✔ Not a single protocol – A protocol suite consisting of multiple
protocols
✔ Strengths: Compatibility with almost all OS, ease of use
✔ Weaknesses: High resource consumption, security vulnerabilities

2. TCP/IP vs. OSI Model

TCP/IP follows a simplified four-layer approach compared to the seven-

layer OSI model.

OSI Model (7 TCP/IP Model (4

Key Protocols
Layers) Layers)

FTP, Telnet, HTTP, SMTP, DNS,

7. Application Application
SNMP

(Merged in
6. Presentation NFS, X Window, TLS
Application)

(Merged in
5. Session NetBIOS, RPC
Application)

4. Transport Transport TCP, UDP

OSI Model (7 TCP/IP Model (4
Key Protocols
Layers) Layers)

3. Network Internet IP, ICMP, IGMP

2. Data Link Network Interface Ethernet, Wi-Fi, PPP, ARP

(Part of Network
1. Physical Fiber, Copper Cables
Interface)

✔ OSI Model (Theoretical) – More detailed but not widely implemented.

✔ TCP/IP Model (Practical) – Focuses on core networking functions.

3. TCP/IP Layers & Protocols

1. Application Layer (Equivalent to OSI Layers 5-7)

 Provides network services to applications.

 Handles file transfers, email, and remote access.

Protocol Purpose

FTP (File Transfer Protocol) Transfers files over a network.

Web browsing & secure

HTTP/HTTPS
communication.

SMTP (Simple Mail Transfer

Email sending.
Protocol)

Translates domain names to IP

DNS (Domain Name System)
addresses.

Telnet Remote terminal access (insecure).

SSH Secure remote access.

2. Transport Layer (OSI Layer 4)

 Responsible for data transport & reliability.

 Uses segmentation, error checking, flow control.

Protocol Type Function

TCP (Transmission Connection- Reliable, ordered data delivery

Protocol Type Function

Control Protocol) oriented (e.g., web browsing, email).

UDP (User Datagram Faster but unreliable (e.g., video

Connectionless
Protocol) streaming, VoIP).

✔ TCP: Used when accuracy matters (web pages, emails, file transfers).
✔ UDP: Used for speed-sensitive applications (live streaming, gaming).

3. Internet Layer (OSI Layer 3)

 Responsible for routing & addressing.

 Uses packet-based communication.

Protocol Purpose

IP (Internet Protocol) Routes packets between networks.

ICMP (Internet Control Message Network diagnostics (Ping,

Protocol) Traceroute).

IGMP (Internet Group Management Manages multicast group

Protocol) memberships.

✔ ICMP Example: ping sends ICMP Echo Requests to check

connectivity.

4. Network Interface Layer (OSI Layers 1-2)

 Manages physical transmission of data.

 Converts packets into frames for transmission.

Technology Purpose

Ethernet Standard wired networking.

Wi-Fi Wireless networking.

Used for direct communication

PPP (Point-to-Point Protocol)
links.

ARP (Address Resolution

Resolves IP to MAC addresses.
Protocol)
4. Key Takeaways

✔ TCP/IP is the backbone of modern networking.

✔ ICMP (Ping, Traceroute) is crucial for network diagnostics.
✔ TCP vs. UDP: Choose TCP for reliability, UDP for speed.
✔ DNS translates domain names to IPs (e.g., [Link] →
[Link]).

Internet Protocol (IPv4 & IPv6)

1. Overview of IP
✔ IP (Internet Protocol) provides logical addressing for networked devices.
✔ Two major versions:

 IPv4 (32-bit, dot-decimal notation) – Still widely used but running out of addresses.
 IPv6 (128-bit, hexadecimal notation) – Introduced to address IPv4 limitations.
2. IPv4 Addressing
✔ Format: Four octets (8-bit values) separated by dots, e.g., [Link].
✔ Range of each octet: 0-255 (0 = network address, 255 = broadcast).

IPv4 Address Components:

Component Definition
Network ID Identifies the network (assigned by ICANN or ISP).
Host ID Identifies a device within the network.
Subnet Mask Defines which part is the Network ID and which is the Host ID.

✔ Example: [Link] / [Link]

 Network: [Link]
 Hosts: [Link] - [Link]
 Broadcast: [Link]

3. IPv4 Private & Reserved Addresses

✔ Private IP Addresses (Non-Routable on the Internet)

Range Subnet Mask Usage

[Link] - [Link] [Link] (Class A) Large private networks.
[Link] - [Link] [Link] (Class B) Medium-sized private networks.
[Link] - [Link] [Link] (Class C) Small networks (home, office).

✔ Loopback Address: [Link] (Used for testing & troubleshooting).

✔ Subnetting Example:

 CIDR Notation: /24 means [Link] (256 addresses).

 Subnetting helps divide networks into smaller segments for efficient management.

4. IPv6 Addressing
✔ Format: Eight groups of four hexadecimal digits separated by colons (:), e.g.,

 2001:0db8:0000:0000:0000:ff00:0042:8329
✔ Shortened Notation:
 Leading zeros can be removed → 2001:db8:0:0:0:ff00:42:8329
 Longest sequence of 0000 can be replaced by :: → 2001:db8::ff00:42:8329
IPv6 Address Types

Type Range Purpose

Global Unicast 2000::/3 Publicly routable IPv6 addresses.
Unique Local (ULA) fc00::/7 Private networks (like IPv4 private IPs).
Auto-assigned for local communication (required for
Link-Local FE80::/10
IPv6).
Multicast FF00::/8 Used to send data to multiple devices.
Loopback ::1 Equivalent to [Link] in IPv4.
Documentation 2001:db8::/32 Reserved for examples/tutorials.

✔ IPv6 does NOT use broadcast but uses multicast instead.

✔ IPv6 has built-in security (IPsec) and better Quality of Service (QoS) support.

5. Key Differences Between IPv4 & IPv6

Feature IPv4 IPv6
Address Size 32-bit 128-bit
Dotted Decimal
Notation Hexadecimal (2001:db8::1)
([Link])
Address Space ~4.3 billion 340 undecillion (2^128)
Yes (10.x, 172.x,
Private Addressing Unique Local (fc00::/7)
192.168.x)
Loopback Address [Link] ::1
Subnet Mask Required Not needed (uses prefix length)
Security Optional (IPsec) Mandatory (IPsec)
Broadcast Yes No (uses multicast instead)
Auto- SLAAC (Stateless Address Auto-
DHCP
Configuration Configuration)

6. Key Takeaways
✔ IPv4 is still widely used, but IPv6 is the future.
✔ Private IPv4 addresses allow reuse, but NAT (Network Address Translation) is
needed for internet access.
✔ IPv6 eliminates the need for NAT and has better built-in security & efficiency.
✔ Both IPv4 and IPv6 will coexist for a long time due to slow adoption.

What is Wi-Fi?
✔ Wi-Fi (Wireless Fidelity) is a wireless networking technology that allows devices to
communicate over a local area network (LAN) without physical cables.
✔ It operates using radio frequency (RF) signals to transmit data between devices and
network infrastructure.

1. Benefits of Wi-Fi
✔ Ease of Deployment: No need for physical cables, making it simple to set up.
✔ Cost-Effective: Cheaper than extensive wired infrastructure.
✔ Mobility & Convenience: Users can move freely within the Wi-Fi signal range.
✔ Scalability: Can support multiple devices and expand with range extenders.

2. Wi-Fi Range & Expansion

✔ Wi-Fi signals typically cover 30-100 meters indoors and up to 500 meters outdoors.
✔ Range Extenders or Mesh Networks can improve coverage in large spaces.

Wi-Fi Signal Influencers:

📌 Obstacles: Walls, furniture, and electronic devices can weaken signals.

📌 Interference: Devices like microwaves, Bluetooth, and neighboring Wi-Fi networks can
cause disruptions.
📌 Antenna Placement: Optimal router placement improves connectivity.

3. Wi-Fi Standards & Speeds

Wi-Fi has evolved with newer standards, offering faster speeds and improved efficiency:

Wi-Fi Standard Max Speed Frequency Band Year Introduced

802.11b 11 Mbps 2.4 GHz 1999
802.11a 54 Mbps 5 GHz 1999
802.11g 54 Mbps 2.4 GHz 2003
802.11n (Wi-Fi 4) 600 Mbps 2.4 & 5 GHz 2009
802.11ac (Wi-Fi 5) 3.5 Gbps 5 GHz 2014
802.11ax (Wi-Fi 6) 9.6 Gbps 2.4 & 5 GHz 2019
802.11be (Wi-Fi 7) 46 Gbps 2.4, 5 & 6 GHz 2024 (Expected)

📌 Wi-Fi 6 & Wi-Fi 7 introduce MU-MIMO (Multi-User, Multiple Input, Multiple

Output) for handling multiple connections efficiently.
4. Wi-Fi Security Risks & Threats
Unlike wired networks, Wi-Fi is more susceptible to attacks since signals travel through
the air.

Common Wi-Fi Security Threats:

✔ Eavesdropping: Attackers intercept unencrypted Wi-Fi traffic using sniffer tools.

✔ Rogue Access Points: Unauthorized devices mimic trusted networks to steal data.
✔ Man-in-the-Middle (MitM) Attacks: Hackers intercept and modify communication.
✔ Denial of Service (DoS): Attackers flood Wi-Fi networks with requests, disrupting
connectivity.
✔ Brute Force Attacks: Hackers attempt to crack weak Wi-Fi passwords.

5. Securing a Wi-Fi Network

Best Practices for Wi-Fi Security:

🔹 Use Strong Encryption: Enable WPA3 or at least WPA2 security.

🔹 Change Default Credentials: Modify default SSID (network name) and router
passwords.
🔹 Enable MAC Address Filtering: Restrict access to known devices only.
🔹 Turn Off SSID Broadcasting: Hide your Wi-Fi name to avoid unwanted connections.
🔹 Keep Firmware Updated: Ensure routers and access points have the latest security
patches.
🔹 Use a Guest Network: Separate IoT and visitor devices from your main network.
🔹 Enable Firewalls & VPNs: Protect data from unauthorized access.

6. Conclusion
✔ Wi-Fi enhances mobility and convenience but introduces security risks.
✔ Implementing strong encryption, access controls, and security policies helps protect
wireless networks.
✔ Newer Wi-Fi standards (Wi-Fi 6, Wi-Fi 7) improve performance, reliability, and
security.

Network Security & TCP/IP Vulnerabilities

1. Network Monitoring & Sniffing

✔ Network Sniffing is the act of capturing and analyzing network traffic to gain sensitive
information.
✔ Attackers use packet sniffers (like Wireshark, tcpdump) to monitor unencrypted data.
✔ Can be used for passive attacks (eavesdropping) or active attacks (modifying data in
transit).

2. Common TCP/IP Vulnerabilities & Attacks

TCP/IP is the core protocol suite of the internet but has several vulnerabilities due to its
open design.

🔹 DoS (Denial of Service) & DDoS (Distributed Denial of Service) Attacks

✔ Attackers flood the network with malicious traffic, making services unavailable.
✔ DDoS uses multiple systems (botnets) to amplify the attack.
✔ Example: SYN Flood Attack—Overloads a system with half-open TCP connections.

🔹 Fragmentation Attacks

✔ Attackers send manipulated fragmented packets to bypass firewalls and intrusion

detection systems (IDS).
✔ Example: Teardrop Attack—Sends overlapping fragmented packets, causing system
crashes.

🔹 Oversized Packet Attacks

✔ Attackers send abnormally large packets (beyond standard MTU size), leading to buffer
overflows and crashes.
✔ Example: Ping of Death—Sends huge ICMP packets to freeze/crash systems.

🔹 Spoofing Attacks

✔ Attackers forge source IP addresses to masquerade as a trusted entity.

✔ Used in phishing, malware distribution, and MitM (Man-in-the-Middle) attacks.
✔ Example: ARP Spoofing—An attacker tricks devices into sending sensitive data to a fake
gateway.

🔹 Man-in-the-Middle (MitM) Attacks

✔ Attackers intercept and alter communications between two parties without their
knowledge.
✔ Can be used to steal credentials, inject malware, or manipulate transactions.
✔ Example: Session Hijacking—Stealing session cookies to impersonate users.

3. How to Secure TCP/IP Networks

🔐 Use Encryption: Implement TLS, SSL, or IPsec to encrypt network traffic.

🔐 Deploy Firewalls & IDS/IPS: Block suspicious traffic and detect anomalies.
🔐 Use Secure Authentication: Implement Multi-Factor Authentication (MFA).
🔐 Patch & Harden Systems: Keep OS and network devices updated.
🔐 Use Network Segmentation: Isolate critical systems from public access.
🔐 Monitor Logs & Traffic: Use SIEM tools (Splunk, ELK) for real-time threat detection.
🔐 Implement Secure Protocols: Use HTTPS, SSH, SFTP instead of plaintext protocols
(HTTP, Telnet, FTP).

Conclusion

✔ TCP/IP is inherently vulnerable to various attacks due to its open nature.

✔ Encryption, monitoring, and strict access controls are key to network security.
✔ Proactive defense measures (firewalls, IDS/IPS, patching) help mitigate risks.

Ports and Protocols (Applications/Services)

1. Understanding Physical & Logical Ports

 Physical Ports → Hardware ports on routers, switches, servers, and computers

(e.g., Ethernet, USB, fiber-optic).
 Logical Ports → Software-based endpoints for communication, identified by port
numbers (0-65535).

2. Role of Ports in Network Communication

✔ A single IP address can handle multiple simultaneous communications via different port
numbers.
✔ Ports are used in TCP/IP Model’s application layer to map data types to specific
services.
✔ Example:

 HTTP (Web traffic) → Port 80

 HTTPS (Secure Web Traffic) → Port 443

3. Port Number Ranges & Classifications

Port Range Type Description

Used by core TCP/IP protocols (e.g., HTTP, DNS, FTP,
0 – 1023 Well-Known Ports
SMTP, SSH).
1024 – Used by vendors & developers (e.g., MS SQL Server,
Registered Ports
49151 RADIUS, Docker API).
49152 – Dynamic/Private Used for temporary communication; assigned
65535 Ports dynamically.
4. Common Ports & Their Services

Port Protocol Service/Application

20, 21 FTP File Transfer Protocol (Data & Control)
22 SSH Secure Shell (Remote Login)
23 Telnet Unencrypted Remote Access (Insecure)
25 SMTP Sending Emails (Mail Servers)
53 DNS Domain Name System (Name Resolution)
67, 68 DHCP Dynamic Host Configuration Protocol (Assign IPs)
80 HTTP Web Traffic (Insecure)
110 POP3 Receiving Emails
143 IMAP Internet Message Access Protocol (Emails)
443 HTTPS Secure Web Traffic
3389 RDP Remote Desktop Protocol
1812 RADIUS Authentication Service
1433/1434 Microsoft SQL Database Management
2375/2376 Docker API Container Management

5. Secure vs. Insecure Ports & Best Practices

✅ Use Secure Versions → Prefer SSH (22) over Telnet (23), HTTPS (443) over HTTP
(80).
✅ Block Unused Ports → Close unnecessary ports to prevent unauthorized access.
✅ Firewall Rules & IDS/IPS → Monitor and control access to critical ports.
✅ Use Encryption → Secure data transfer using TLS, SSL, or IPsec.

Secure vs. Insecure Ports and Protocols

Certain network protocols transmit data in plaintext, making them vulnerable to network
sniffing, interception, and attacks. Secure alternatives should be used to encrypt and
protect data in transit.

Comparison of Insecure and Secure Ports

Insecure Secure
Protocol Description Secure Protocol
Port Alternative
80 HTTP Web traffic sent in plaintext 443 HTTPS (SSL/TLS)
Windows file-sharing, NFS (with
445 SMB 2049
vulnerable to exploits encryption)
SFTP (Secure FTP
21 FTP Transfers files in plaintext 22
over SSH)
Remote shell access without
23 Telnet 22 SSH (Secure Shell)
encryption
Email sending without
25 SMTP 587 SMTP with TLS
encryption
 Insecure Secure
Protocol Description Secure Protocol
Port Alternative
NTP (Network Time
37 Time Legacy time synchronization 123
Protocol)
Domain name resolution
53 DNS 853 DoT (DNS over TLS)
without encryption
Email retrieval without
143 IMAP 993 IMAP with SSL/TLS
encryption
Network device monitoring SNMPv3 (with
161/162 SNMP 161/162
(plaintext) encryption)
Directory services without LDAPS (LDAP with
389 LDAP 636
encryption SSL/TLS)

Key Recommendations for Secure Network Communication

✅ Use HTTPS (443) instead of HTTP (80) → Encrypts web traffic to prevent sniffing.
✅ Use SSH (22) instead of Telnet (23) → Secures remote administration.
✅ Block SMB (445) at network perimeters → Prevents file-sharing vulnerabilities.
✅ Prefer SFTP (22) over FTP (21) → Secure file transfer with encryption.
✅ Enforce TLS encryption for email protocols (SMTP, IMAP, LDAP).
✅ Upgrade SNMP to version 3 → Ensures encrypted device monitoring.
✅ Block unused ports & apply firewall rules to minimize attack surfaces.

🔐 Common Types of Cyber Threats 🚨

Organizations face a variety of cyber threats that can steal, corrupt, or disrupt their data and
operations. Below are some of the most common threats:

1️⃣ Spoofing 🎭

🔹 Description: Attackers falsify their identity to gain unauthorized access.

🔹 Targets:

 IP addresses
 MAC addresses
 Usernames
 Wireless network SSIDs
 Email addresses
🔹 Mitigation: Use authentication mechanisms (e.g., SPF, DKIM, and DMARC for
email).

2️⃣ Denial-of-Service (DoS) / Distributed DoS (DDoS) Attacks 🌐

🔹 Description: Overwhelms a system with excessive requests, making it unusable.
🔹 DDoS Attacks: Uses multiple systems (botnets) to amplify the attack.
🔹 Mitigation: Deploy firewalls, rate-limiting, and traffic filtering solutions.

3️⃣ Worms 🪱

🔹 Description: Self-replicating malware that spreads across networks without user action.
🔹 Impact: Can consume system resources, steal data, or install additional malware.
🔹 Mitigation: Keep systems patched and deploy network segmentation.

4️⃣ On-Path Attack (Man-in-the-Middle - MITM) 🔍

🔹 Description: Attackers intercept communication between two parties.

🔹 Impact: Can modify or steal sensitive data.
🔹 Mitigation: Use TLS encryption, VPNs, and multi-factor authentication (MFA).

5️⃣ Advanced Persistent Threat (APT) 🏴‍☠️

🔹 Description: Long-term, stealthy cyberattacks targeting organizations or nations.

🔹 Attackers: Often state-sponsored or highly organized cybercriminal groups.
🔹 Mitigation: Implement zero-trust security, behavioral monitoring, and regular audits.

6️⃣ Malware (Malicious Software) 🦠

🔹 Description: Any program designed to steal, destroy, or corrupt data.

🔹 Types:

 Viruses: Attach to files and require user action to spread.

 Trojans: Disguised as legitimate software but perform malicious tasks.
 Ransomware: Encrypts files and demands payment for decryption.
🔹 Mitigation: Use endpoint protection, antivirus software, and regular backups.

7️⃣ Ransomware 🔒

🔹 Description: A type of malware that encrypts files and demands a ransom (usually in
cryptocurrency) to restore access.
🔹 How it Works:
 1. Infection: Spreads through phishing emails, malicious links, or software
vulnerabilities.
2. Execution: Encrypts files and displays a ransom note.
3. Extortion: Demands payment for a decryption key.
4. Double Extortion: Some ransomware gangs steal data before encryption, threatening
to leak it.
🔹 Mitigation:

 Regular backups (stored offline).

 Endpoint protection and email filtering.
 Security patches to fix software vulnerabilities.
 Zero-trust security model.

8️⃣ Phishing 🎣

🔹 Description: Deceptive emails or messages trick users into revealing sensitive info.
🔹 Variations:

 Spear Phishing: Targeted attacks on specific individuals.

 Whaling: Targets high-profile individuals like executives.
 Smishing/Vishing: Phishing via SMS or voice calls.
🔹 Mitigation: User awareness training, email filtering, and MFA.

9️⃣ Side-Channel Attacks 🔬

🔹 Description: Attackers analyze power usage, timing, or emissions to extract data.

🔹 Examples:

 Timing attacks: Measure execution time to infer sensitive info.

 Electromagnetic attacks: Analyze signals emitted by devices.
🔹 Mitigation: Use shielding, cryptographic obfuscation, and hardware security
measures.

🔟 Insider Threats 🏢

🔹 Description: Employees or trusted users (either intentional or accidental) compromise

security.
🔹 Causes:

 Disgruntled employees
 Negligence (falling for phishing or social engineering)
  Espionage (leaking data to competitors)
🔹 Mitigation: Use least privilege access, user behavior monitoring, and DLP (Data
Loss Prevention).

Tools to Identify and Prevent Threats

Tools and Their Functions
Identifie Prevents
Tools Description
s Threats Threats

Detects abnormal activity,

Intrusion Detection
intrusion attempts, and ✅ ❌
System (IDS)
system failures.

Host-based IDS Monitors activity on a single

✅ ❌
(HIDS) computer.

Monitors and evaluates

Network-based IDS
network activity to detect ✅ ❌
(NIDS)
attacks or anomalies.

Gathers log data from

SIEM (Security sources across an enterprise
Information and to understand security ✅ ❌
Event Management) concerns and allocate
resources.

Anti-malware/ Identifies malicious software

✅ ✅
Antivirus or processes.

Evaluates the effectiveness

Scans ✅ ❌
of security controls.

Filters, manages, and

Firewall controls network traffic to ✅ ✅
protect the network.

Intrusion Prevention An active IDS that detects

System (IPS - and blocks attacks before ✅ ✅
NIPS/HIPS) they reach target systems.
Intrusion Detection and Prevention
Systems (IDS & IPS)
Understanding Intrusion Detection Systems (IDS)

An intrusion occurs when an attacker bypasses or thwarts security

mechanisms to gain access to an organization's resources. An Intrusion
Detection System (IDS) helps detect these security breaches by
inspecting logs and real-time system events to identify intrusion
attempts and system failures.

Key Functions of IDS:

 Works as part of a defense-in-depth security strategy,

complementing but not replacing firewalls.

 Detects external attacks (e.g., internet-based threats) and

internal threats (e.g., malware spreading within the network).

 Upon detecting suspicious activity, IDSs send alerts or raise alarms

for quick response.

Types of IDS:

IDSs are categorized into two primary types based on their monitoring
scope:

1. Host-Based Intrusion Detection System (HIDS)

A HIDS monitors a single system or host for suspicious activity,

including:

 Process calls.

 System, application, and security logs.

 Host-based firewall logs.

Advantages of HIDS:

✅ Detects anomalies on the host that network-based IDSs (NIDS)

cannot.
✅ Can identify specific files compromised during an attack.
✅ Tracks processes used by attackers, helping in forensic
investigations.

Limitations of HIDS:
❌ Cannot monitor network-wide attacks affecting other systems.
❌ Requires more administrative effort, as it must be installed on each
system individually.

2. Network-Based Intrusion Detection System (NIDS) 🌐

A NIDS monitors network activity to detect attacks and anomalies. It

inspects network traffic patterns and can detect signs of cyber threats
across multiple systems.

Advantages of NIDS:

✅ Can monitor large networks using remote sensors placed at key

locations (e.g., routers, firewalls, network switches).
✅ Has minimal impact on system performance, as it operates
independently of host machines.

Limitations of NIDS:

❌ Cannot analyze encrypted traffic.

❌ Cannot confirm if an attack was successful in compromising systems,
files, or user accounts.

Security Information and Event Management (SIEM)

SIEM solutions collect, aggregate, and analyze log data from multiple
security sources to provide real-time visibility into potential security
threats.

Key Functions of SIEM:

 Centralized log collection for security monitoring.

 Correlates events across different security tools (firewalls, IDS,

antivirus, etc.).

 Helps organizations understand security threats and allocate

resources effectively.

 Enhances an organization's overall security posture as part of a

defense-in-depth strategy.

Intrusion Detection vs. Intrusion Prevention

Feature IDS (Detection) IPS (Prevention)

Action Detects & alerts Detects & blocks

Monitors logs & network

Placement Inline with network traffic
traffic

Passive (requires manual Active (automatically blocks

Response
action) threats)

Performance
Minimal Can introduce latency
Impact

Preventing Cyber Threats: Best Practices &

Technologies
1. Fundamental Security Measures
While no single method can protect against all threats, the following basic steps can
significantly reduce risks:

🔹 Keep Systems & Applications Updated

 Vendors release patches to fix bugs and security vulnerabilities.

 Patch management ensures that all systems and applications remain up to date.

🔹 Use Intrusion Detection & Prevention Systems (IDS/IPS)

 IDS (Intrusion Detection System) monitors and alerts on suspicious activities.

 IPS (Intrusion Prevention System) not only detects threats but actively blocks them
before reaching the target.

🔹 Deploy Firewalls for Network Security

 Network-based firewalls protect entire networks.

 Host-based firewalls safeguard individual systems.
 Next-Generation Firewalls (NGFWs) integrate IDS, IPS, antivirus, identity access
management (IAM), web filtering, and VPNs for advanced security.

🔹 Remove or Disable Unneeded Services & Protocols

 If a service or protocol is unnecessary, disable it to reduce attack surface.

 Example: Running unnecessary services on a web server exposes it to multiple attack
vectors.
🔹 Use Up-to-Date Anti-Malware Software

 Modern anti-malware solutions detect:

o Viruses
o Rootkits
o Ransomware
o Spyware
 Enterprise anti-malware solutions integrate with firewalls, IDS/IPS, and endpoint
protection platforms.

2. Intrusion Prevention System (IPS)

An IPS is an advanced form of IDS that actively blocks attacks before they reach the
system.

🔸 How IPS Works:

 Placed inline with traffic to analyze packets in real-time.

 Can automatically block malicious traffic based on predefined rules.

🔸 IPS Deployment Types:

 Network-based IPS (NIPS): Protects entire networks.

 Host-based IPS (HIPS): Monitors and secures individual systems.

IPS is commonly integrated into firewalls, forming a crucial defense-in-depth layer.

3. Vulnerability & Port Scanning

 Regular vulnerability scans identify unpatched systems, misconfigurations, and
new security gaps.
 Port scans reveal open ports that may be exposed to attacks.

🔹 Example Port Scan Results (Zenmap/Nmap Output)

nginx
CopyEdit
Scanning 6 hosts [1000 ports/host]
Discovered open port 143/tcp on [Link]
Discovered open port 80/tcp on [Link]
Discovered open port 22/tcp on [Link]
Discovered open port 3306/tcp on [Link] (MySQL Database)
Discovered open port 443/tcp on [Link] (HTTPS)

 Open ports increase attack risk and must be secured with firewalls, access controls,
and patching.
4. Firewalls: Traditional vs. Next-Generation
Traditional Firewalls

 Filters traffic based on IP addresses, ports, and protocols (Layer 3 & 4).
 Enforces basic access control rules.

Next-Generation Firewalls (NGFWs)

 Includes deep packet inspection (DPI), IDS/IPS, and advanced malware

protection.
 Provides Application Layer (Layer 7) security, ensuring only legitimate traffic is
allowed.

Feature Traditional Firewalls Next-Gen Firewalls (NGFWs)

Traffic Filtering Based on IP & Port Deep Packet Inspection
Intrusion Prevention ❌ Not Included ✅ Built-in IDS/IPS
Application Control ❌ No Awareness ✅ Application Filtering
Malware & Bot Protection ❌ Limited ✅ Integrated

5. Compliance & Security Best Practices

 Antivirus software is a mandatory requirement for compliance with the Payment
Card Industry Data Security Standard (PCI DSS).
 Organizations must regularly audit security controls to ensure effectiveness

On-Premises Data Centers

Organizations have two primary options when it comes to data centers: they can either
outsource the data center or own and operate it on-premises. If the data center is owned, it
must be housed in a suitable facility with adequate power, HVAC (Heating, Ventilation, and
Air Conditioning), fire suppression, and redundancy mechanisms.

Physical Infrastructure & Security

The wiring infrastructure within the facility is crucial for overall system security and
reliability. Protecting access to the physical network layer is essential to prevent both
intentional and unintentional damage. Ensuring physical security involves addressing various
challenges related to access control and environmental protection.

1. Data Center & Wiring Closets

Data centers and wiring closets typically house:

  Phone, network, and special connections
 ISP or telecommunications provider equipment
 Servers
 Wiring and/or switch components

High-density equipment and enclosed spaces require efficient cooling and airflow
management. Industry standards recommend:

 Maintaining a temperature range between 64°F to 81°F (18°C to 27°C) for optimized
uptime and hardware longevity.
 Installing three temperature sensors at the top, middle, and bottom of racks to
measure the actual operating temperature.

Proper temperature management, including effective cooling solutions, is essential for

preventing equipment failure and ensuring optimal performance.

2. HVAC (Heating, Ventilation, and Air Conditioning) & Environmental

Factors

Cooling is only one aspect of environmental control. Other considerations include:

 Contaminant Control: Dust, noxious fumes, and airborne particles can damage
sensitive equipment. Proper filtration and monitoring systems must be in place.
 Leak & Failure Monitoring: Detection systems should monitor for:
o Water or gas leaks
o Sewer overflows
o HVAC system failures
o Power fluctuations
 Contingency Planning: Organizations must prioritize responses to system failures to
minimize impacts on operations, infrastructure, and personnel safety.

3. Power Management

Consistent and high-quality power delivery is critical for data center operations. Power
management strategies include:

 Backup Generators: These must be sized appropriately to support both critical

computing resources and supporting infrastructure.
 Battery Backups (UPS - Uninterruptible Power Supply): Systems should be
designed to sustain operations until generators can start and stabilize.
 Regular Testing: As with data backups, power failover mechanisms must be
regularly tested to ensure reliability during outages.

Fluctuations in power quality can shorten equipment lifespan, while power disruptions can
lead to complete system shutdowns, making robust power management essential.

4. Fire Suppression

Fire detection and suppression in server rooms must be designed based on:
  Room size
 Occupancy levels
 Egress (exit) routes
 Risk of damage to electronic equipment

Common fire suppression methods:

 Water-based suppression: Effective for general areas but can cause severe damage
to electronic components.
 Gas-based suppression (e.g., FM-200, CO2, or Inergen systems): More suitable for
protecting electronic equipment but can pose toxicity risks to humans.

Ensuring the right fire suppression system is in place helps balance human safety with the
need to protect critical IT infrastructure.

Conclusion

On-premises data centers require extensive planning and management to maintain security,
environmental control, power stability, and fire safety. Proper implementation of these
strategies ensures high availability, reliability, and longevity of data center operations.

Redundancy
Redundancy refers to designing systems with duplicate components to ensure continuous
operation in case of failure. This principle is critical for data centers to maintain high
availability and minimize downtime.

A thorough risk assessment of the data center should determine whether multiple separate
utility service entrances are required for redundant communication channels and power
sources.

To achieve full redundancy, key components should have:

 Dual power supplies for critical devices, connected to independent power sources.
 Backup power solutions, including uninterruptible power supplies (UPS) and
generators.
 Redundant generators, ideally using different fuel types to prevent single points of
failure.

By implementing these redundancy measures, organizations can enhance the reliability and
resilience of their data center infrastructure.

Memorandum of Understanding (MOU) &

Memorandum of Agreement (MOA)
Organizations seeking to enhance Business Continuity (BC) and Disaster Recovery (DR)
often establish agreements with similar organizations. These agreements ensure that in the
event of an emergency, one organization can temporarily utilize the facilities and resources of
another to maintain critical operations.

Types of Agreements

 Memorandum of Understanding (MOU)

 Memorandum of Agreement (MOA)
 Joint Operating Agreement (JOA)

These agreements sometimes involve competitors within the same industry because their
infrastructure is similar, making it easier to support each other during disruptions.

Example Scenario

Consider two competing hospitals, Hospital A and Hospital B, in the same city. They
establish an MOU stating that if Hospital A experiences a disaster (e.g., fire, flood, power
outage), it can temporarily relocate critical operations and staff to Hospital B, and vice versa.
Instead of competing on security and safety, both hospitals focus on service, price, and
patient care while ensuring the healthcare industry’s resilience.

Difference Between MOU/MOA and SLA

 MOA/MOU: Focuses on broad collaborative agreements regarding what can be

done with systems, resources, or information in case of disruptions.
 Service-Level Agreement (SLA): Defines specific service expectations, such as IT
support response times, uptime guarantees, and access to cloud backup systems.

Importance of SLAs in Cloud Services

When outsourcing cloud-based services, organizations must carefully review SLAs to ensure
they meet operational needs. For example, if an SLA guarantees 100% access, does that
mean immediate access to data, or only access through the provider’s portal during business
hours? Legal teams play a crucial role in reviewing terms and conditions before finalizing
agreements.

Cloud Computing
Cloud computing refers to an internet-based set of computing resources typically provided
as a service by a Cloud Service Provider (CSP). It allows organizations to access on-
demand computing power, storage, and applications without needing to maintain physical
infrastructure.

Understanding Cloud Computing

Cloud computing operates similarly to the electrical power grid—users access resources via
a standard interface and pay only for what they use. The underlying infrastructure and
geographic provisioning are managed by the CSP and often remain transparent to the
consumer.
Key Characteristics of Cloud Computing

According to NIST SP 800-145, cloud computing is:

 Scalable – Expands or reduces resources as needed.

 Elastic – Automatically adjusts based on demand.
 On-Demand – Services are available when required.
 Accessible – Enables network access from anywhere.
 Minimal Management Effort – Resources are provisioned with minimal user or
provider interaction.

NIST Definition of Cloud Computing

“A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of
configurable computing resources (such as networks, servers, storage, applications, and
services) that can be rapidly provisioned and released with minimal management effort or
service provider interaction.”
— NIST SP 800-145

Cloud Computing Service Models

Cloud services are categorized into three primary models:

1. Software as a Service (SaaS) – Users access software applications over the internet
(e.g., Google Workspace, Microsoft 365).
2. Platform as a Service (PaaS) – Provides a platform for developers to build and
deploy applications (e.g., AWS Elastic Beanstalk, Google App Engine).
3. Infrastructure as a Service (IaaS) – Delivers virtualized computing resources, such
as servers, storage, and networking (e.g., AWS EC2, Microsoft Azure).

Cloud Deployment Models

Organizations can choose from different cloud deployment strategies based on their business
needs:

 Private Cloud – Dedicated infrastructure for a single organization.

 Public Cloud – Infrastructure and services shared among multiple users (e.g., AWS,
Azure, Google Cloud).
 Hybrid Cloud – A combination of private and public cloud environments.
 Community Cloud – Shared infrastructure for specific organizations with common
concerns (e.g., government or healthcare).

Cloud Characteristics
Cloud computing provides on-demand access to computing resources, enabling
organizations to scale rapidly, reduce costs, and improve operational efficiency. Cloud-
based assets include any resources accessed via the cloud, typically leased from an external
provider.
Key Characteristics of Cloud Computing

1. On-Demand Self-Service – Users can provision and manage computing resources

without human intervention from the service provider.
2. Broad Network Access – Services are available over the internet and accessible
from multiple devices, including laptops, tablets, and smartphones.
3. Resource Pooling – Cloud providers use multi-tenancy models where computing
resources are shared among multiple customers, optimizing efficiency.
4. Rapid Elasticity – Cloud resources can automatically scale up or down based on
demand, ensuring efficient performance and cost-effectiveness.
5. Measured Service – Cloud usage is metered and billed based on consumption,
making costs transparent and predictable.

Benefits of Cloud Computing for Organizations

 Cost Reduction – No need for upfront hardware investments, reducing capital

expenditures (CapEx) and operational costs (OpEx).
 Scalability & Flexibility – Easily adjust resources to meet changing demands.
 Lower Energy & Cooling Costs – Reduces infrastructure maintenance, leading to a
"green IT" environment.
 Faster Deployment – Enables rapid implementation of software or data-based
solutions without installing hardware locally.

Cloud Service & Deployment Models

Cloud Service Models Cloud Deployment Models

SaaS (Software as a Service) – Delivers applications
Private Cloud – Dedicated to a
via the cloud (e.g., Google Workspace, Microsoft
single organization.
365).
PaaS (Platform as a Service) – Provides a
Public Cloud – Shared infrastructure
development environment (e.g., AWS Elastic
(e.g., AWS, Azure, Google Cloud).
Beanstalk).
IaaS (Infrastructure as a Service) – Offers
Hybrid Cloud – Combination of
virtualized resources (e.g., AWS EC2, Microsoft
public and private cloud.
Azure VMs).

Cloud Service Models

Cloud computing service models define the level of control and responsibility between the
cloud service provider (CSP) and the consumer. These models range from fully managed
solutions to infrastructure-based services where customers maintain more control.

Types of Cloud Computing Service Models

1. Software as a Service (SaaS)

  Definition: A fully managed cloud service where software applications are provided
over the internet.
 Responsibility: The CSP manages everything—including infrastructure, security,
application updates, and maintenance.
 Examples: Google Workspace, Microsoft 365, Salesforce, Dropbox.
 Advantages:
o No need for local installation.
o Automatic updates and patching.
o Accessible from any device with an internet connection.

2. Platform as a Service (PaaS)

 Definition: A cloud service that provides a development environment, including

operating systems, development frameworks, and databases.
 Responsibility: The CSP manages infrastructure and runtime environments, while the
consumer manages application deployment.
 Examples: AWS Elastic Beanstalk, Google App Engine, Microsoft Azure App
Services.
 Advantages:
o Developers focus on building applications without managing infrastructure.
o Scalable and cost-effective for application development.
o Pre-built tools and services streamline the development process.

3. Infrastructure as a Service (IaaS)

 Definition: A cloud service model that provides virtualized computing resources

(servers, storage, networking) over the internet.
 Responsibility: The consumer is responsible for managing operating systems,
applications, and data, while the CSP maintains the underlying hardware.
 Examples: Amazon EC2, Microsoft Azure Virtual Machines, Google Compute
Engine.
 Advantages:
o Complete control over virtualized infrastructure.
o Scalable based on workload demands.
o Pay-as-you-go pricing reduces upfront costs.

Shared Responsibility Model

 SaaS: CSP manages everything, including security and updates.

 PaaS: CSP manages infrastructure; consumer manages applications.
 IaaS: CSP provides hardware; consumer manages OS, security, and applications.

Cloud Deployment Models

Cloud deployment models define how cloud resources are made available to users. They
determine ownership, accessibility, and control over cloud infrastructure and services.

Four Cloud Deployment Models

1. Public Cloud

 Definition: A cloud service available to the general public, hosted and managed by a
third-party cloud service provider (CSP).
 Ownership: Managed entirely by the CSP.
 Accessibility: Available to anyone who subscribes.
 Examples: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform
(GCP).
 Advantages:
o Scalability: Easily scales up or down based on demand.
o Cost-Effective: Pay-per-use model reduces upfront investments.
o Maintenance-Free: CSP handles updates, security, and infrastructure
management.
 Disadvantages:
o Limited Control: Customers rely on CSP for security and compliance.
o Security Risks: Shared resources could be vulnerable to external threats.

2. Private Cloud

 Definition: A cloud infrastructure dedicated to a single organization, hosted on-

premises or by a third-party provider.
 Ownership: Managed internally by the organization or a dedicated provider.
 Accessibility: Available only to the organization’s employees or users.
 Examples: VMware vSphere Private Cloud, OpenStack, Microsoft Azure Stack.
 Advantages:
o Enhanced Security & Privacy: Ideal for sensitive data and regulatory
compliance.
o Full Control: Customizable to meet specific business needs.
o Better Performance: Dedicated resources prevent performance issues from
external users.
 Disadvantages:
o Higher Costs: Requires upfront investment in infrastructure.
o Management Overhead: Requires in-house expertise for maintenance.

3. Hybrid Cloud

 Definition: A combination of public and private cloud environments, allowing data

and applications to be shared between them.
 Ownership: Partially owned by the organization, with some services outsourced to a
CSP.
 Accessibility: Organizations can keep critical workloads in a private cloud while
leveraging public cloud resources for scalability.
 Examples: AWS Outposts, Microsoft Azure Hybrid Cloud, Google Anthos.
 Advantages:
o Flexibility: Balance between cost savings and security.
o Scalability: Use public cloud resources when demand spikes.
o Business Continuity: Backup and disaster recovery options available.
 Disadvantages:
o Complex Management: Requires integration between public and private
clouds.
 o Security Challenges: Data movement between clouds must be secured.

4. Community Cloud

 Definition: A cloud environment shared by organizations with common interests,

such as industry-specific compliance requirements.
 Ownership: Managed by multiple organizations or a third party.
 Accessibility: Available only to members of the community.
 Examples: Government cloud services, financial industry clouds, healthcare
consortium clouds.
 Advantages:
o Industry Compliance: Designed to meet shared regulatory requirements.
o Cost Sharing: Reduces IT costs for individual members.
o Collaboration: Allows similar organizations to share resources securely.
 Disadvantages:
o Limited Availability: Restricted to specific organizations or industries.
o Complex Agreements: Requires governance structures to manage shared
resources.

Managed Service Provider (MSP)

 A Managed Service Provider (MSP) is a company that remotely manages a
customer's IT infrastructure and services, either partially or entirely. Organizations,
especially small and medium-sized businesses (SMBs), outsource IT functions to
MSPs to reduce costs, improve efficiency, and gain access to specialized expertise.


 Roles & Responsibilities of an MSP

 🔹 IT Infrastructure Management – Monitors and maintains servers, networks,

storage, and cloud environments.
🔹 Security & Compliance – Provides firewall management, intrusion detection, and
compliance with industry standards (e.g., HIPAA, PCI DSS).
🔹 Help Desk & Support – Offers remote and on-site technical support for IT issues.
🔹 Network & Security Monitoring – Identifies threats, prevents cyberattacks, and
ensures system uptime.
🔹 Patch & Update Management – Keeps systems updated with security patches and
software upgrades.
🔹 Backup & Disaster Recovery – Implements cloud and on-premises backup
solutions for business continuity.
🔹 Managed Detection & Response (MDR) – Monitors and investigates security
incidents using advanced threat detection tools.
🔹 Cloud & SaaS Management – Helps businesses migrate, configure, and manage
cloud applications like Microsoft 365, Google Workspace, and AWS.
🔹 Payroll & HR Services – Some MSPs also provide payroll and HR functions as
part of business process outsourcing (BPO).


 Types of Managed Services Offered

 ✅ Fully Managed IT Services – The MSP takes full responsibility for an

organization’s IT infrastructure.
✅ Co-Managed IT Services – MSP works alongside an internal IT team to
supplement expertise and resources.
✅ Security-as-a-Service (SECaaS) – Specialized cybersecurity services, including
SIEM, endpoint protection, and threat intelligence.
✅ Cloud-Based MSP Services – Management of cloud platforms such as AWS,
Azure, and Google Cloud.


 Advantages of Using an MSP

 ✔ Cost-Effective – Reduces the need for a full-time in-house IT team.

✔ Access to Expertise – Provides specialized skills in security, networking, and
cloud computing.
✔ 24/7 Monitoring & Support – Ensures system availability and quick response to
incidents.
✔ Improved Security & Compliance – Helps meet industry regulations and protect
sensitive data.
✔ Scalability & Flexibility – Allows businesses to scale IT services as they grow.

 Service-Level Agreement (SLA) in Cloud

Computing
 A Service-Level Agreement (SLA) is a contract between a cloud service provider
(CSP) and a cloud service customer that defines the quality, availability, security,
and responsibilities of the cloud services provided.


 Key Components of an SLA

 📌 Service Availability & Performance – Defines uptime guarantees (e.g., 99.9%

availability) and response times.
📌 Data Security & Privacy – Specifies how customer data is protected, encrypted,
and accessed.
📌 Disaster Recovery & Backup – Outlines backup frequency, recovery times
(RTO/RPO), and failover mechanisms.
📌 Data Location & Compliance – Identifies where data is stored and ensures
compliance with regulations (e.g., GDPR, HIPAA).
📌 Problem Identification & Resolution – Describes incident management,
response times, and escalation processes.
 📌 Change Management – Covers updates, patches, and service changes.
📌 Exit Strategy & Data Portability – Ensures smooth migration if the customer
decides to change providers.
📌 Right to Audit – Allows customers to audit the CSP’s security and compliance.
📌 Dispute Mediation & Penalties – Specifies penalties for SLA violations and
resolution mechanisms.


 Why SLAs Are Important?

 ✅ Ensures Reliability – Establishes expectations for uptime and service quality.

✅ Defines Accountability – Holds CSPs accountable for security and compliance.
✅ Provides Legal Protection – Helps in case of disputes or failures.
✅ Ensures Transparency – Clearly defines responsibilities of both parties.

Network Design & Security Concepts

Network design involves structuring an IT environment to ensure security, scalability, and
efficiency while facilitating smooth data communication. Several security and segmentation
techniques are used to control traffic and protect sensitive information.

Key Network Design Elements

1️⃣ Network Segmentation

 Controls traffic flow between devices.

 Enhances security by limiting unauthorized access.
 Can be physical (isolated networks) or logical (using VLANs).

2️⃣ Demilitarized Zone (DMZ)

 A buffer network between the internal (private) network and external users.
 Hosts public-facing services (e.g., web servers, email servers).
 Prevents direct access to the internal network.

3️⃣ Virtual Local Area Network (VLAN)

 Logically segments networks using switches without changing physical

infrastructure.
 Improves security and performance by isolating network traffic.
 VLANs reduce broadcast traffic and enhance control over data flows.

4️⃣ Virtual Private Network (VPN)

 Encrypts communication over an untrusted network (like the Internet).

 Provides secure remote access for users.
  Used for site-to-site or client-to-site secure connections.

5️⃣ Defense in Depth (DiD)

 Implements multiple security layers to prevent unauthorized access.

 Uses firewalls, IDS/IPS, endpoint protection, NAC, and multi-factor
authentication (MFA).
 Ensures that if one security layer fails, others remain active.

6️⃣ Network Access Control (NAC)

 Enforces security policies before granting network access.

 Controls which devices/users can connect based on compliance (e.g., antivirus, OS
patches).
 802.1X authentication is commonly used in NAC implementation.

Why Proper Network Design Matters?

✔ Enhances Security – Prevents unauthorized access & mitigates threats.

✔ Improves Performance – Reduces congestion & optimizes traffic flow.
✔ Simplifies Management – Allows better segmentation & policy enforcement.
✔ Supports Compliance – Helps meet regulations like ISO 27001, HIPAA, PCI-DSS.

Defense in Depth (DiD) - A Layered Security Approach

Defense in Depth (DiD) is a multi-layered security strategy that

ensures an organization’s data, applications, and systems are
protected at multiple levels. This approach minimizes security risks by
providing redundant protections, so if one layer is compromised, other
layers continue to protect the system.

Defense in Depth Layers

🛡 1. Data Security

 Protects the core assets (data) using:

✔ Encryption (AES, TLS)
✔ Data Loss Prevention (DLP)
✔ Access Controls (IAM, MFA)

🛡 2. Application Security

 Protects applications from unauthorized access and vulnerabilities:

✔ Web Application Firewalls (WAFs)
 ✔ Secure Coding Practices
✔ Database Security & Monitoring

🛡 3. Host Security (Endpoints)

 Secures individual devices and servers:

✔ Antivirus & Endpoint Detection and Response (EDR)
✔ Patch Management
✔ Endpoint Firewalls & Configuration Hardening

🛡 4. Internal Network Security

 Protects traffic flow & user access within the network:

✔ Intrusion Detection/Prevention Systems (IDS/IPS)
✔ Internal Firewalls
✔ Network Access Control (NAC)

🛡 5. Perimeter Security

 Prevents unauthorized external access to the network:

✔ Gateway Firewalls & Secure DMZ
✔ Honeypots & Malware Sandboxing
✔ DDoS Protection

🛡 6. Physical Security

 Prevents unauthorized physical access to IT infrastructure:

✔ Access Control (Badges, Biometrics, CCTV)
✔ Locks & Server Room Security
✔ Environmental Controls (Fire Suppression, HVAC)

🛡 7. Policies, Procedures & Awareness

 Enforces security best practices and reduces insider threats:

✔ User Security Awareness Training
✔ Incident Response & Risk Management Policies
✔ Ethical Hacking & Penetration Testing
Why Use Defense in Depth?

✔ Reduces attack surface by applying multiple security layers.

✔ Mitigates single points of failure with redundant security controls.
✔ Ensures compliance with standards like ISO 27001, NIST, PCI-DSS.
✔ Improves resilience against evolving cyber threats.

Zero Trust Security Model

🔒 "Never Trust, Always Verify" is the core principle of the Zero Trust security model.
Unlike traditional perimeter-based security, Zero Trust assumes that threats exist both
inside and outside the network. Every user, device, and system must be authenticated,
authorized, and continuously monitored before accessing resources.

Key Concepts of Zero Trust

🛑 1. Microsegmentation

 Divides the network into smaller, isolated segments.

  Limits lateral movement of attackers.
 Example: A finance server should not be accessible by an HR employee.

🔄 2. Least Privilege Access (LPA)

 Users and devices get only the minimum access needed.

 Example: A marketing employee should not have access to engineering databases.

🔐 3. Continuous Verification

 Always validate user identity, device security, and context.

 Uses Multi-Factor Authentication (MFA), Adaptive Access, and Behavioral
Analytics.

🖥 4. Device & Endpoint Security

 Every device is authenticated before access is granted.

 Uses Endpoint Detection & Response (EDR), Antivirus, and Device Posture
Checks.

🛡 5. Identity-Centric Security

 User Authentication & Access Controls take priority over network location.
 Uses Single Sign-On (SSO), Identity Federation, and Conditional Access Policies.

Zero Trust vs. Traditional Security

Traditional Security 🏰 Zero Trust 🚦

Trusts users & devices inside the
Trusts no one—verification required.
network.
Single firewall protects entire
Microsegmentation isolates resources.
network.
Username & password for Uses MFA, biometrics, and behavior-based
authentication. authentication.
Implicit trust once inside the
Continuous monitoring & verification.
network.
Hard to stop lateral movement. Prevents unauthorized access inside the network.

Real-World Analogy: Rock Concert 🎸

🎫 Traditional Security:

 You show your ticket at the entrance.

 Once inside, you have free access to the entire venue—even backstage!

🔐 Zero Trust Security:

  You show your ticket at the entrance.
 You verify again to enter the main stage area.
 You verify one more time to access backstage (restricted areas).
 Multiple checkpoints ensure only authorized individuals gain access.

Zero Trust Technologies

✅ Identity & Access Management (IAM) – MFA, SSO, Conditional Access

✅ Network Segmentation & Firewalls – Next-Gen Firewalls (NGFW), Microsegmentation
✅ Endpoint Security – Antivirus, EDR, Zero Trust Network Access (ZTNA)
✅ Behavioral Analytics – AI-driven anomaly detection & user behavior tracking
✅ Data Security – Encryption, Data Loss Prevention (DLP)

Why Zero Trust?

✔ Prevents Lateral Movement – Stops cybercriminals from spreading once inside.

✔ Minimizes Insider Threats – Enforces strict user verification & least privilege access.
✔ Protects Cloud & Remote Users – Ensures secure access for hybrid & remote
workforces.
✔ Reduces Attack Surface – Focuses on data security instead of perimeter defense.

Network Access Control (NAC) - Securing Network

Access
🔍 What is NAC?
Network Access Control (NAC) is a security framework that enforces strict access policies
on who, what, and how devices connect to an organization's network. It ensures only
authenticated, compliant, and authorized devices gain access.

Why is NAC Important?

✔ Protects Critical Network Assets 🏢

✔ Prevents Unauthorized Access & Insider Threats 🔐
✔ Secures IoT & BYOD Devices 📲
✔ Ensures Policy Compliance ✅
✔ Provides Network Visibility & Control 🌐

Evolution of Network Access

📌 Past: Internal devices were the only ones connected.
📌 Present:

 BYOD (Bring Your Own Device) – Employees connect personal laptops &
smartphones.
 IoT (Internet of Things) – Smart sensors, HVAC systems, security cameras, etc.
 Guest/Contractor Access – External users require temporary access.

As networks grow, NAC ensures every device follows strict security policies before
accessing the network.

How NAC Works

🔍 1. Device Identification & Authentication

 Identifies who is trying to connect (e.g., employee, contractor, guest).

 Checks what type of device (e.g., laptop, IoT device, mobile phone).

🚦 2. Policy Enforcement & Access Control

 Compliant devices → Full or limited access based on roles & privileges.

 Non-compliant devices → Quarantined or blocked until they meet security
policies.

🛡 3. Continuous Monitoring & Incident Response

 Detects unauthorized activity & policy violations.

 Isolates compromised devices to prevent lateral movement of threats.

NAC Use Cases

🏥 Medical Devices – Protect hospital networks from unauthorized access.

📡 IoT Devices – Secure smart cameras, sensors, and industrial control systems.
📱 BYOD & Mobile Devices – Ensure employee-owned devices meet security standards.
🧑‍💼 Guest & Contractor Access – Enforce policies for temporary network users.

Key Capabilities of NAC Solutions

✅ Network Visibility – Identifies all connected devices & users.

✅ Endpoint Compliance Checks – Ensures security policies are met (e.g., antivirus,
encryption).
✅ Role-Based Access Control (RBAC) – Grants access based on user roles.
✅ Quarantine & Remediation – Isolates and fixes non-compliant devices.
✅ Integration with Security Tools – Works with firewalls, SIEM, IAM, and EDR
solutions.

Network Segmentation: Demilitarized Zone (DMZ)

🔐
What is Network Segmentation?
Network segmentation divides a network into smaller, isolated sections to control traffic
and enhance security. A DMZ (Demilitarized Zone) is a critical part of this strategy, acting
as a buffer zone between an organization's internal network and external sources (e.g., the
internet).

📌 What is a DMZ?

A Demilitarized Zone (DMZ) is a network segment that hosts public-facing services while
isolating them from the internal network.

📍 Purpose:
✔ Protects internal systems from external threats.
✔ Limits exposure of critical applications & services.
✔ Enhances network security using firewalls & access controls.

DMZ Architecture

🔹 Single Firewall DMZ

 A single firewall with separate network zones (Internal, DMZ, External).

 Less secure, as a single breach may expose the DMZ & internal network.

🔹 Dual Firewall DMZ (Recommended)

 Firewall 1 (External) → Filters traffic between the internet & DMZ.

 Firewall 2 (Internal) → Controls access between the DMZ & internal network.
 Provides stronger isolation & security.

🌐 Common DMZ Use Cases

📌 Web Servers – Hosts public websites without exposing the internal network.
📌 Email Servers – Filters email traffic before it reaches internal servers.
📌 DNS Servers – Protects internal DNS servers from direct external queries.
📌 Application Servers – Segments enterprise applications to limit access.
📌 Proxy & Reverse Proxy Servers – Secures inbound & outbound traffic.
Security Benefits of a DMZ

✅ Reduces Attack Surface – Limits the exposure of internal resources.

✅ Enhances Access Control – Filters traffic using firewalls & security policies.
✅ Prevents Direct Access – Only specific services (e.g., web, email) are accessible.
✅ Improves Traffic Monitoring – Logs & analyzes all traffic entering the network.
✅ Supports Zero Trust – Requires strict access policies for DMZ-based services.

🚀 Best Practices for Implementing a DMZ

🔸 Use a Dual Firewall Setup for maximum security.

🔸 Restrict Traffic Flow – Limit access between DMZ & internal networks.
🔸 Implement Intrusion Detection & Prevention Systems (IDS/IPS).
🔸 Harden DMZ Servers – Remove unnecessary services & enforce strong security settings.
🔸 Regularly Update & Patch DMZ servers to fix vulnerabilities.
🔸 Monitor & Log Traffic to detect suspicious activity early.
ChatGPT said:

Segmentation for Embedded Systems and IoT 🌐🔒

📌 What Are Embedded Systems?

An embedded system is a dedicated computing system within a larger device, designed

for a specific function.

🔹 Examples of Embedded Systems:

✔ Smart TVs & Streaming Devices (Roku, Fire TV, Chromecast)
✔ HVAC Controls & Smart Thermostats
✔ Medical Devices (Pacemakers, MRI machines)
✔ Network-Attached Printers
✔ Game Consoles & Smart Appliances

🌍 What Is IoT?

The Internet of Things (IoT) refers to network-connected devices that communicate over
the internet to monitor & control real-world processes.

🔹 Examples of IoT Devices:

✔ Smart home systems (lights, security cameras, door locks)
✔ Wearables (smartwatches, fitness trackers)
✔ Industrial IoT (automated factory machines, sensors)
⚠️Why IoT and Embedded Systems Need Security?

🚨 Security Risks:
❌ Weak Authentication – Many devices use default passwords.
❌ Unpatched Vulnerabilities – Devices may lack security updates.
❌ Multiple Access Points – Devices use Wi-Fi, Bluetooth, Ethernet, increasing attack
surfaces.
❌ Potential Physical Damage – Hacked IoT devices (e.g., industrial sensors) could cause
real-world harm.

Network Segmentation for IoT Security

✅ VLANs (Virtual LANs): Separate IoT traffic from corporate & personal devices.
✅ Firewall Rules: Restrict device communication to only necessary IPs & services.
✅ MAC Address Filtering: Limit access to approved IoT devices.
✅ Access Control Lists (ACLs): Define who can interact with IoT devices.
✅ Protocol Filtering: Block unauthorized traffic types (e.g., Bluetooth, Telnet).
✅ Zero Trust Network (ZTN): Require continuous identity verification for IoT devices.

🚀 Best Practices for Securing IoT & Embedded Systems

🔸 Change Default Credentials – Use unique, strong passwords.

🔸 Update Firmware & Software – Patch security flaws regularly.
🔸 Disable Unused Services & Ports – Close unnecessary access points.
🔸 Monitor IoT Traffic – Detect anomalies & suspicious activity.
🔸 Use Encrypted Communication – Protect data transfers using TLS & VPNs.
🔸 Apply Physical Security – Lockdown critical IoT devices.

🌐 Virtual Local Area Network (VLAN)

A Virtual Local Area Network (VLAN) allows network administrators to create logical
network segments using switches, without requiring physical separation. VLANs
improve network efficiency, reduce congestion, and enhance security.

📌 How VLANs Work

✔ VLANs group devices as if they are on the same network, even if they are physically
separated.
✔ Devices within a VLAN communicate as if they are on the same Layer 2 network.
✔ VLANs isolate broadcast traffic, reducing network congestion.
✔ Communication between VLANs requires a Layer 3 device (Router or Layer 3 Switch).

📊 Benefits of VLANs

✅ Traffic Segmentation: Divides the network logically for better organization.

✅ Improved Security: Restricts access between VLANs, reducing unauthorized access.
✅ Reduced Broadcast Storms: Limits broadcast traffic to the assigned VLAN only.
✅ Simplified Management: VLANs can be reassigned without changing physical wiring.
✅ Enhanced Performance: Reduces network congestion by controlling unnecessary traffic.

📍 Types of VLANs

🔹 Port-based VLAN: Assigns VLANs based on specific switch ports.

🔹 MAC-based VLAN: Assigns VLANs based on device MAC addresses.
🔹 Protocol-based VLAN: Groups devices based on network protocols (e.g., IPv4 vs. IPv6).
🔹 IP Subnet VLAN: Assigns VLANs based on IP address ranges (e.g., 192.168.1.x vs.
192.168.2.x).
🔹 Voice VLAN: Optimized for VoIP traffic, ensuring low latency & high QoS.

⚠️VLAN Security Concerns

🚨 VLAN Hopping Attack – Malicious users exploit misconfigured VLANs to intercept

traffic from other VLANs.
🚨 Double Tagging Attack – Attackers insert multiple VLAN tags to bypass security
controls.
🚨 MAC Flooding Attack – Overloads a switch’s MAC table, forcing it to behave like a hub,
exposing VLAN traffic.

VLAN Security Best Practices

✔ Disable Unused Ports – Prevent unauthorized access.

✔ Use VLAN Access Control Lists (ACLs) – Restrict inter-VLAN traffic.
✔ Disable Auto-Trunking (DTP) – Prevent unauthorized VLAN trunking.
✔ Use Strong Authentication (802.1X) – Secure port access.
✔ Implement Private VLANs (PVLANs) – Isolate sensitive devices within a VLAN.
✔ Use Layer 3 Firewalls for VLAN Traffic Filtering – Control who can communicate
between VLANs.

Virtual Private Network (VPN)

A Virtual Private Network (VPN) is a secure point-to-point connection between two
devices or networks over an untrusted network (e.g., the internet). VPNs can provide
encryption, authentication, and integrity protection, but this depends on how they are
configured.

📌 How VPNs Work

✔ VPNs create a private communication channel over a public network.

✔ Data is encrypted before transmission to prevent eavesdropping.
✔ VPNs allow remote users to securely access a private network.
✔ Organizations use site-to-site VPNs to connect branch offices.

📊 Types of VPNs

🔹 Remote Access VPN – Enables individual users to securely access a corporate network.
🔹 Site-to-Site VPN – Connects entire networks securely over the internet.
🔹 Client-to-Site VPN – A hybrid approach where employees securely access the office
network from their devices.
🔹 MPLS VPN – Uses Multiprotocol Label Switching (MPLS) for faster and secure private
connections.

🔐 Common VPN Security Protocols

✔ IPSec (Internet Protocol Security): Provides encryption & authentication for secure
communication.
✔ SSL/TLS VPN (Secure Socket Layer): Uses web browsers for encrypted access (e.g.,
AnyConnect, OpenVPN).
✔ L2TP/IPSec (Layer 2 Tunneling Protocol): A common VPN protocol used for remote
access.
✔ IKEv2/IPSec (Internet Key Exchange v2): Provides fast and stable connections, ideal
for mobile VPN users.
✔ WireGuard: A modern VPN protocol offering speed and strong encryption.

⚠️VPN Security Risks

🚨 Man-in-the-Middle (MITM) Attacks – Intercepting unencrypted VPN traffic.

🚨 DNS Leaks – Exposing real IP addresses and browsing activities.
🚨 Weak Encryption – Poorly configured VPNs may not provide proper security.
🚨 Malicious VPN Providers – Free or untrusted VPNs may log data or sell user information.
Best Practices for Secure VPN Usage

✔ Use Strong Encryption (AES-256, IPSec, WireGuard, OpenVPN)

✔ Enable Multi-Factor Authentication (MFA) for VPN logins
✔ Regularly Update VPN Software & Patch Vulnerabilities
✔ Use Split Tunneling Wisely – Prevent sensitive data from leaking
✔ Implement VPN Logging & Monitoring to detect suspicious activities
✔ Limit VPN Access Based on Role-Based Access Control (RBAC)

Microsegmentation: Enhancing Security in the Data

Center
Microsegmentation is a network security strategy that provides granular control over
traffic flows within a data center, restricting access between workloads even if they are on
the same network. This approach minimizes lateral movement in case of a cyberattack and
enhances Zero Trust security.

📌 Why is Microsegmentation Important?

🚀 Stops Lateral Movement – Prevents attackers from moving freely inside the network after
breaching one system.
🚀 Improves Zero Trust Security – Enforces least privilege access to services and
applications.
🚀 Reduces Attack Surface – Limits exposure by allowing only necessary communication
between devices.
🚀 Enhances Compliance – Helps meet regulatory requirements like PCI DSS, HIPAA, and
GDPR by isolating sensitive data.

🔎 Key Characteristics of Microsegmentation

✔ Granular Security Controls – Rules can be applied per machine, per application, or
per user.
✔ Traffic Flow Analysis – Understands east-west (internal) and north-south (internet)
traffic patterns.
✔ Software-Defined – Works independent of physical network boundaries, unlike
VLANs.
✔ Policy-Based Enforcement – Uses dynamic policies instead of static security models.
How Microsegmentation Works

1️⃣ Identify Workloads & Traffic Patterns – Map application dependencies and
communication flows.
2️⃣Create Segmentation Policies – Define rules for which workloads or applications can
talk to each other.
3️⃣ Enforce Policies Dynamically – Implement security controls using firewalls, ACLs, or
software-defined solutions.
4️⃣ Monitor & Adjust – Continuously analyze traffic and refine policies as needed.

🔥 Microsegmentation vs. Traditional Segmentation

Traditional Segmentation
Feature Microsegmentation
(VLANs)
Granularity Limited to network subnets Per workload, user, or process
Security Focus Perimeter-based Workload-based
Hardware-dependent (routers, Software-defined (firewalls,
Implementation
switches) hypervisors)
Attack Surface Broad (shared networks) Minimal (restricted access)

🔐 Best Practices for Microsegmentation Implementation

✔ Use Software-Defined Security (NSX, Illumio, Guardicore, Cisco Tetration)

✔ Enforce Least Privilege Access – Restrict east-west traffic between applications
✔ Leverage Identity-Based Controls – Restrict access based on users & roles
✔ Automate Policy Enforcement – Use AI/ML-driven analytics to adjust segmentation
✔ Integrate with Zero Trust – Always verify devices and users before allowing
communication

Domain 5: Security Operations

Data Handling

1. Understanding Data Handling

Data goes through a structured life cycle as it is created, processed, stored, shared, archived,
and eventually destroyed. Managing this data properly is crucial for security, compliance,
and operational efficiency.

Organizations follow a Data Security Life Cycle to apply security controls at every stage
and ensure that data remains confidential, intact, and available to authorized users.
2. Data Security Life Cycle Stages
Stage Explanation Security Considerations
Data is generated by users, applications, or - Apply access controls to
automated processes. It is usually in an restrict unauthorized creation.
Create
unstructured form (raw data, logs, documents) - Ensure data classification to
before being formatted and stored. assign sensitivity levels.
- Use encryption to protect
stored data.
- Implement regular backups
Data is saved in a physical or digital format
Store to prevent data loss.
(databases, file servers, cloud storage).
- Apply access control policies
to restrict who can view/edit
stored data.
Use Data is accessed, modified, or processed by users - Implement role-based access
or applications. control (RBAC).
 Stage Explanation Security Considerations
- Use data masking to hide
sensitive information.
- Monitor for unauthorized
access or unusual activity.
- Secure data in transit using
TLS/SSL encryption.
- Apply data loss prevention
Data is transmitted or copied between users, (DLP) policies to prevent
Share
departments, or external entities. unauthorized sharing.
- Use digital rights
management (DRM) for
sensitive information.
- Ensure long-term encryption
of archived data.
- Implement retention policies
Data that is not actively used is stored for long-
Archive for compliance (e.g., GDPR,
term retention (e.g., compliance records, old logs).
HIPAA).
- Store in offline or air-gapped
storage for high security.
- Use secure deletion methods
(shredding, degaussing,
Data is permanently removed when no longer cryptographic erase).
Destroy
needed. - Follow data disposal
regulations to avoid legal
issues.

3. Data States & Security Measures

At every stage in the lifecycle, data exists in one of three states:

A. Data in Use (Being processed or modified)

 Data is actively being accessed or manipulated by users, applications, or systems.

 Risks: Insider threats, malware attacks, unauthorized modifications.
 Security Measures:
o Access control mechanisms (Role-Based Access Control - RBAC).
o Data masking (hiding sensitive data for unauthorized users).
o Endpoint security tools (prevent malware attacks).

B. Data at Rest (Stored in databases, files, or backups)

 Data is not actively being accessed but is stored on hard drives, databases, cloud
storage, USB drives, etc.
 Risks: Data breaches, insider threats, unauthorized access.
 Security Measures:
o Full-disk encryption for sensitive data.
 o Access control lists (ACLs) to restrict access.
o Regular backup and disaster recovery plans.

C. Data in Motion (Transferred over networks)

 Data is being moved between locations, such as from a user to a server or between
cloud services.
 Risks: Interception, data leakage, man-in-the-middle (MITM) attacks.
 Security Measures:
o TLS/SSL encryption for secure web communication.
o Virtual Private Network (VPN) for remote access.
o Secure email gateways to prevent phishing attacks.

4. Importance of the Data Security Life Cycle

The Data Security Life Cycle helps organizations to:
✅ Protect data integrity and confidentiality throughout its lifecycle.
✅ Comply with regulatory standards like GDPR, HIPAA, ISO 27001, and NIST.
✅ Reduce risks of data breaches by implementing strong security controls.
✅ Improve operational efficiency with structured data governance.

5. Best Practices for Data Security

1. Data Classification & Labeling
o Categorize data based on sensitivity (Public, Internal, Confidential,
Restricted).
o Apply security controls accordingly.
2. Access Controls & Authentication
o Implement Multi-Factor Authentication (MFA).
o Use Least Privilege Principle – grant users only the necessary access.
3. Encryption Everywhere
o Encrypt data at rest, in use, and in motion.
o Use AES-256 encryption for high-security environments.
4. Regular Security Audits
o Conduct vulnerability assessments and penetration testing.
o Monitor user activities for suspicious behavior.
5. Secure Data Disposal
o Follow ISO 27040 standards for data destruction.
o Use degaussing, shredding, or cryptographic erase for hardware disposal.

Conclusion
The Data Security Life Cycle provides a structured approach to managing and securing
data from creation to disposal. Organizations must implement strong security policies,
encryption, access controls, and compliance measures to prevent unauthorized access, data
breaches, and loss of sensitive information.

Data Handling Practices

1. Introduction to Data Handling Practices

 Data Value:
Data is recognized as a valuable asset for any organization. When data is properly
handled, it supports decision-making, competitive advantage, and efficient operations.
However, if sensitive information is not adequately protected, organizations risk
exposure, competitive loss, or even severe organizational harm.
 Purpose of Classification:
Classification provides a way to group data based on its sensitivity. This grouping
makes it easier to design and implement consistent security controls. For example,
data labeled as “highly restricted” will require much stronger protection compared to
“low sensitivity” data.

2. Data Classification and Labeling

 What is Classification?
Classification is the process of evaluating data to determine its sensitivity and the
potential impact on the organization if that data is compromised. This evaluation is
based on factors such as confidentiality, integrity, and availability.
 Steps in Classification:
1. Assessment:
 Determine the potential impact or loss if the data is compromised.
 Consider legal, regulatory, and contractual requirements.
2. Labeling:
 Once data is assessed, it is assigned a sensitivity label.
 Labels indicate how data should be handled, stored, and shared.
 Typical Classification Levels:

o Highly Restricted:
 Data whose compromise could threaten the very existence of the
organization.
 Could lead to severe loss of life, injury, property damage, or significant
litigation.
o Moderately Restricted:
 Data whose exposure might cause temporary competitive
disadvantages, revenue loss, or disrupt operations.
 o Low Sensitivity/Internal Use Only:
 Data that, if compromised, might cause only minor operational
disruptions.
o Unrestricted/Public Data:
 Data that is already available to the public and whose disclosure does
not pose a risk.

 Benefits of Classification:

o Efficiency: Security measures can be standardized based on data

classification.
o Risk Management: Helps organizations focus their resources on protecting
the most sensitive information.
o Compliance: Assists in meeting legal and regulatory data protection
requirements.

3. Data Retention Practices

 Definition:
Data retention refers to keeping information for only as long as it is useful or required
by legal, regulatory, or business needs.
 Key Points for Data Retention:
o Retention Policies:
 Policies should define how long different types of data should be
retained.
 These policies apply to both hard copies and electronic data.
o Inventory Management:
 It is essential to maintain an accurate inventory of data assets,
including their location and retention requirements.
o Periodic Reviews:
 Regular audits of stored records help reduce the volume of data and
ensure compliance with retention requirements.
o Risks of Over-Retention:
 Keeping data beyond its useful life not only wastes storage resources
but also increases the risk of exposure.
 Unnecessarily stored data adds “noise” and complicates searches for
relevant records.
o External Requirements:
 Organizations must adhere to industry standards, laws, or contractual
obligations that dictate retention periods.
 Non-compliance can result in fines or other legal consequences.

4. Data Destruction Practices

  Definition:
Data destruction is the process of permanently removing data when it is no longer
needed, ensuring that sensitive information cannot be recovered.
 Key Methods for Data Destruction:
o Clearing:
 Involves writing over data with random patterns (or zeros) to overwrite
the original data.
 Note: Simply writing zeros may not be sufficient if any storage area is
missed, leaving recoverable remnants.
o Purging:
 Goes further than clearing by reducing the likelihood of recovering any
residual physical traces of data.
 Often used for systems where high sensitivity requires that data
recovery is extremely unlikely.
o Physical Destruction:
 The ultimate measure to ensure data is unrecoverable.
 Methods include shredding, chopping, breaking, acid etching, or
burning storage devices.
 Used especially when media like magnetic disks or optical storage are
being decommissioned or replaced.
 Understanding Data Remanence:
o Definition:
 Remanence refers to the residual representation of data that remains
even after attempts to clear it.
o Security Concern:
 Leftover “ghosts” of data on storage media can be exploited by
attackers if not properly managed.
o Mitigation:
 Use robust data-clearing procedures and, when necessary, purging or
physical destruction to mitigate risks.
 Best Practices for Destruction:
o Policy Compliance:
 Ensure that destruction is performed according to both organizational
policies and legal or regulatory requirements.
o Documentation:
 Keep an accurate record of destroyed data, including the method and
date of destruction.
o Regular Reviews:
 Periodically verify that data destruction processes are effective and
updated in line with technological advancements.

5. Summary and Best Practices

 Data Handling is a Multi-Step Process:
o Classification and Labeling: Identify and mark data according to sensitivity.
o Retention: Store data only as long as needed.
 o Destruction: Ensure complete and secure deletion of data past its retention
period.
 Efficiency and Security:
o Proper classification allows for more efficient security processes by applying
uniform controls to similarly sensitive data.
o It minimizes risks and ensures that sensitive information is not unnecessarily
exposed or retained.
 Policy and Compliance:
o Always align data handling practices with internal policies as well as external
legal, regulatory, and contractual requirements.
o Regular reviews and audits are crucial to maintain compliance and safeguard
data integrity.

Logging and Monitoring Security

Events

1. Overview
 Purpose:
Logging and monitoring are vital for maintaining the health of an organization's
information environment. They help in:
o Detecting inefficient or malfunctioning systems.
o Identifying potential security compromises.
o Providing accountability through a recorded trail of system activities.
 Importance:
By capturing and reviewing logs, organizations can trace activities back to specific
users or systems, support forensic investigations, and establish a baseline for normal
operations.

2. Understanding Logging
 Definition:
Logging is the process of recording events—actions that take place within the systems
environment. These events cause measurable or observable changes in system
elements.
 Key Points:
o Instrumentation: Logging acts as the primary form of instrumentation to
capture signals generated by system events.
o Computational Cost: While logging imposes computational and storage
overhead, it is indispensable for accountability and post-incident analysis.
o Event Types:
 User activities (e.g., logon, logoff, access attempts).
  System activities (e.g., configuration changes, error events).
 Security events (e.g., unauthorized access, activation or deactivation of
protection mechanisms).
 Benefits:
o Helps identify and correlate activities across diverse systems.
o Provides a rich source of data for detecting policy violations, fraud, and
operational issues.

3. Monitoring Security Events

 Definition:
Monitoring involves actively reviewing and analyzing logged data to detect abnormal
behavior, security incidents, and operational issues in near-real time.
 Key Aspects:
o Log Reviews:
 Regular reviews are essential for early detection of incidents.
 They support audits and forensic investigations.
 Historic log analysis can reveal if known vulnerabilities have been
exploited in the past.
o Correlation:
 Combining logs from different sources helps create a full picture of an
event's context.
 Effective correlation can pinpoint relationships between seemingly
unrelated activities.
 Best Practices:
o Design a robust log management infrastructure.
o Establish policies for periodic log review.
o Implement automated tools for real-time monitoring and correlation.
o Ensure logs are stored securely to maintain integrity and confidentiality.

4. Log Management Infrastructure

 Components:
o Log Collection: Capturing raw log data from various devices and systems.
o Log Storage: Securely storing logs while adhering to retention policies.
o Log Analysis: Tools and processes to analyze log data, correlate events, and
generate alerts.
o Log Integrity and Protection:
 Controls to prevent unauthorized modification or deletion.
 Mechanisms to ensure the confidentiality of sensitive log data.
 Security Considerations:
o Protect log files from accidental or malicious alteration.
o Retain logs as required by law, regulation, and internal governance.
o Preserve original logs to prevent attackers from covering their tracks.
5. Essential Information in Logs
Logs typically contain crucial details such as:

 User IDs: Identifying the user involved in an event.

 System Activities: Documenting what actions were performed.
 Timestamps: Recording dates and times for key events (e.g., logon, logoff).
 Device and Location Information: Tracking which device or physical location
generated the log.
 Access Attempts: Recording both successful and unsuccessful access to systems or
resources.
 System Configuration Changes: Noting when and how system settings are
modified.
 Protection Events: Logging activation and deactivation of security measures.

6. Benefits and Challenges

 Benefits:
o Enhanced accountability and traceability of actions.
o Improved ability to detect and respond to security incidents.
o Support for compliance with industry and regulatory standards.
 Challenges:
o Managing the computational cost and storage requirements.
o Ensuring logs remain unaltered and confidential.
o Maintaining an effective balance between the volume of data collected and
actionable insights.

7. Summary
 Logging and monitoring form the backbone of an effective security strategy by
ensuring that every relevant action within the information environment is recorded
and analyzed.
 Proper design of logging environments, combined with regular log reviews, is crucial
to identify potential threats, support investigations, and maintain a secure operational
baseline.
 Adhering to retention policies and protecting log data integrity are essential
components of a robust log management framework.

These detailed notes encapsulate the key concepts and best practices for Logging and
Monitoring Security Events. They highlight the importance of systematic logging, proactive
monitoring, and the security measures required to maintain an effective and secure logging
infrastructure.
Data Security Event Example

1. Overview of the Data Security Event Example

 Raw Log Nature:
The example provided is a raw log entry that captures system events. Raw logs are the
initial form of recorded data and might appear cryptic, but they contain crucial details
that can help identify security breaches.
 Purpose:
The primary purpose of this raw log is to identify if someone attempted to break into a
secure file and hijack the server. It acts as an early warning system to alert security
engineers of potential intrusion attempts.

2. Key Components in the Example

 Attempted Access and Port Information:
o Secure File Access: The log is used to check for any unusual or unauthorized
access to secure files.
o Port Usage:
 Secure Port vs. Questionable Port: Security engineers look at the
port information to determine whether the access attempt was made
through a secure, expected port or a questionable one.
 Implications:
 A secure port is typically designated for legitimate
communications, whereas a questionable port might indicate a
method used by attackers to penetrate the network.
 Interpretation by Security Engineers:
o Engineers develop familiarity with common codes and log entries.
o They use this understanding to determine the nature of the threat—identifying
exactly who might be attempting the breach and from where.

3. Importance of Proactive Security Planning

 Security Must Be Built-In:
o The example emphasizes that information security is not an add-on feature
that can be plugged in as needed.
o Proactive Design:
 Security should be designed into the system from the beginning, even
before any data is introduced into the network.
 This proactive approach ensures that the system is robust against
potential threats from the outset.
  Patching vs. Fundamental Security:
o Patching:
 While patching (updating existing systems) is important, it cannot
compensate for fundamental weaknesses in system design.
o Secure System Foundation:
 If a system is not inherently secure, no amount of patching or reactive
measures will fully protect it.
 A secure system must incorporate robust security measures from the
initial design phase.

4. Practical Implications of the Example

 Detection of Unauthorized Activities:
o The raw log enables the identification of specific actions that may indicate an
attempted breach.
o Security engineers can correlate different log entries to create a comprehensive
picture of potential intrusions.
 Forensic Analysis and Accountability:
o Logs provide an audit trail that is invaluable for forensic investigations.
o They help determine who attempted the breach and how the attack was
executed.
 Modern Security Systems:
o While more user-friendly interfaces exist today, the underlying principles
remain the same.
o Even modern systems benefit from detailed raw log analysis as it provides the
depth of information necessary for thorough investigations.

5. Key Takeaways
 Understand the Role of Raw Logs:
o Raw logs are the building blocks of security monitoring and are crucial for
detecting and understanding security events.
 Recognize the Need for Early Security Integration:
o Security must be integrated into the system from the very beginning. Waiting
until vulnerabilities are exploited to implement security measures is not
sufficient.
 Correlate Events Effectively:
o Detailed log analysis and correlation enable security engineers to piece
together the sequence of events and determine the source and method of any
intrusion attempt.
 Plan Proactively:
o A secure system isn’t achieved merely by patching but through comprehensive
planning and robust design, ensuring security is an inherent part of the
network architecture.
Event Logging Best Practices

1. Overview
 Purpose of Event Logging:
Event logging is essential for detecting, investigating, and mitigating potential
security incidents. It captures data about system events and network traffic, enabling
security teams to track suspicious activities and respond in a timely manner.
 Best Practices:
Best practices involve using specialized tools and implementing monitoring strategies
tailored to the direction of traffic—ingress (incoming) and egress (outgoing).

2. Ingress Monitoring
 Definition:
Ingress monitoring focuses on surveillance and assessment of all inbound
 communications. It helps detect unauthorized access attempts, malware infections, or
any other threat entering the network.
 Key Tools & Devices:
o Firewalls: Filter inbound traffic based on predetermined security rules.
o Intrusion Detection Systems (IDS): Monitor network traffic for suspicious
patterns or known threats.
o Intrusion Prevention Systems (IPS): Actively block malicious traffic based
on identified threats.
o Security Information and Event Management (SIEM) Solutions:
Aggregate and analyze log data for real-time alerting and incident response.

3. Egress Monitoring
 Definition:
Egress monitoring focuses on regulating and inspecting data leaving the
organization’s IT environment. It is critical in preventing data exfiltration and
ensuring that sensitive data does not leave the network unauthorized.
 Key Tools & Devices:
o Data Loss Prevention (DLP) Solutions:
 DLP is designed to inspect all forms of data leaving the organization.
 It monitors data flows such as email (including content and
attachments), file transfers (e.g., via FTP), and postings to websites.
o Gateways & Remote Authentication Servers: Monitor access and control
data exiting through external connections.
o Portable Media Controls: Track or restrict the copying of data to portable
storage devices.
o SIEM Solutions: Also play a role in egress monitoring by correlating logs
from various sources.

4. Additional Monitoring Tools

 Email & Gateway Monitoring:
o Monitor emails for sensitive data disclosures.
o Gateways inspect data packets for compliance with security policies.
 Application & API Logging:
o Monitor API calls and application logs to detect unusual patterns or data
requests.
 Anti-malware Solutions:
o Identify and prevent malware from both entering and exiting the network.

5. Integration and Correlation

  Comprehensive Approach:
Combining ingress and egress monitoring helps create a complete picture of network
activity.
 SIEM Integration:
SIEM solutions serve as a centralized platform for collecting, correlating, and
analyzing data from all sources, enabling effective incident detection and response.

6. Key Best Practices

1. Implement Specialized Tools:
o Deploy tools that specifically address ingress (firewalls, IDS/IPS) and egress
(DLP, gateways) monitoring.
2. Continuous Monitoring and Alerting:
o Ensure that logging tools are configured to provide real-time alerts for
suspicious activities.
3. Data Correlation:
o Use SIEM solutions to aggregate and correlate logs from multiple devices,
making it easier to identify complex attack patterns.
4. Regular Review and Auditing:
o Periodically review log data and adjust monitoring configurations to address
emerging threats.
5. Policy Enforcement:
o Define and enforce policies for what constitutes acceptable inbound and
outbound data flows, ensuring compliance with regulatory requirements.

7. Summary
Event logging best practices involve a multi-layered approach that monitors both ingress and
egress traffic. By deploying specialized tools like firewalls, IDS/IPS, DLP solutions, and
SIEM platforms, organizations can effectively detect and respond to security incidents.
Regular audits, real-time alerting, and robust policy enforcement are key to maintaining a
secure IT environment.

Encryption Overview

1. Introduction to Cryptography
  Definition:
Cryptography is the science of protecting information by transforming it into an
unreadable format for unauthorized users. This transformation ensures that only those
with the appropriate decryption method (or key) can convert it back to its original
form.
 Importance in the Digital World:
o Secures personal and business transactions.
o Verifies authenticity through digitally signed software updates and contracts.
o Plays a crucial role in ensuring data confidentiality, integrity, and non-
repudiation.

2. Key Components of an Encryption System

A. Plaintext

 Definition:
Plaintext is the original, unencrypted data or message.
 Examples:
o Human-readable text, images, audio, video files.
o Numeric data, database records, and any digital information.
 Note:
While often readable, plaintext might include formats not immediately understandable
by humans, especially when in raw binary form.

B. Encryption

 Definition:
Encryption is the process of converting plaintext into ciphertext using an algorithm
and a key.
 Purpose:
To render the information unintelligible to anyone who does not have the appropriate
decryption key.

C. Ciphertext

 Definition:
Ciphertext is the encrypted form of the plaintext.
 Characteristics:
It appears as a random or scrambled set of characters or bits.
 Objective:
To ensure that without the correct decryption key, the data remains inaccessible and
meaningless.

D. Key
  Definition:
A key is a piece of information (a string of bits) used by an encryption algorithm to
transform plaintext into ciphertext and vice versa.
 Role in Security:
o The strength of an encryption system often depends on the key’s length and
randomness.
o Key management is essential for ensuring that keys remain secure and are only
accessible to authorized parties.

E. Cryptovariables

 Definition:
These include various parameters used by encryption algorithms (in addition to the
key) that might influence the encryption process.
 Examples:
o Initialization vectors (IVs)
o Nonces (numbers used once)
 Purpose:
To add randomness and ensure that identical plaintexts produce different ciphertexts
each time.

3. How Encryption Provides Security

A. Confidentiality

 Concept:
Confidentiality ensures that the message remains secret and is accessible only to those
with the correct decryption key.
 Implementation:
o Hiding the message content via encryption.
o Using strong encryption algorithms and effective key management.

B. Integrity

 Definition:
Integrity ensures that the data has not been altered during transmission or storage.
 Tools:
o Hash Functions: Produce a fixed-size output (hash) from input data; any
change in data results in a different hash.
o Digital Signatures: Verify the authenticity and integrity of a message,
ensuring it was not tampered with by either the sender or during transmission.

C. Non-repudiation

 Definition:
Non-repudiation prevents a party from denying the authenticity of their signature on a
document or the sending of a message.
  Mechanism:
Often achieved through digital signatures that bind the identity of the sender to the
transaction or communication.

4. The Encryption Process in Detail

1. Input (Plaintext):
The original data that needs to be protected.
2. Encryption Process:
o Algorithm:
A set of rules or mathematical procedures (e.g., AES, RSA) used to perform
the encryption.
o Key Application:
A key is applied along with the algorithm and any necessary cryptovariables to
transform the plaintext.
3. Output (Ciphertext):
The result is ciphertext, which appears random and unintelligible without decryption.
4. Decryption Process:
o Reversing the Encryption:
Using the correct decryption key and algorithm, the ciphertext is converted
back to plaintext.
o Ensuring Data Integrity:
Along with confidentiality, verification of the data’s integrity ensures that the
decrypted message is authentic and unaltered.

5. Practical Applications of Encryption

  Secure Communications:
Email encryption, VPNs, and secure messaging rely on encryption to protect data.
 Digital Signatures:
Verify the authenticity of digital documents, ensuring that contracts, software, and
updates are genuine.
 Data Protection:
Encryption safeguards sensitive data stored in databases, on cloud storage, or
transmitted across networks.

6. Key Takeaways
 Cryptography is essential for protecting digital information from unauthorized
access.
 Encryption transforms plaintext into ciphertext to maintain confidentiality.
 Decryption reverses the process using a key, allowing authorized users to access the
original data.
 Integrity and non-repudiation are critical services provided by cryptographic
methods, ensuring data remains unaltered and authenticated.
 Effective key management is as important as the encryption process itself in
maintaining overall security.

Configuration Management Overview

1. What is Configuration Management?
 Definition:
Configuration management (CM) is a process that ensures only authorized and
validated changes are made to IT systems.
 Purpose:
o Ensures stability and reliability of systems.
o Helps maintain security by tracking and controlling modifications.
o Provides a structured approach to managing system updates, patches, and
configurations.

Key Components of Configuration Management

1. Identification
2. Baselines
3. Change Control
4. Verification & Audit

Configuration Management Process

A. Identification

 What it Includes:
o Creating an inventory of all hardware, software, and information assets.
o Keeping track of components, configurations, and dependencies.
 Why It Matters:
o "You can’t protect what you don’t know you have."
o Identifying assets is the first step in securing them.
o Helps with system classification based on value and risk.

B. Baseline Management

 Definition:
A baseline is a complete inventory of all components in a system, including:
o Hardware
o Software
o Data
o Documentation
o Security controls
 Purpose of Baselines:
o Establishes a reference point for security and performance.
o Ensures that all future changes can be compared to an approved standard.
o Helps track system integrity over time.
 Security Baselines:
o Define minimum security requirements for different asset classifications
(e.g., high, medium, low).
o Ensure compliance with industry standards (e.g., PCI DSS, NIST).

C. Change Control

 Definition:
Change control ensures that all modifications (updates, patches, system
improvements) follow a structured approval process.
 Change Control Process:
1. Request & Approval:
 Any system change must be documented and approved before
implementation.
2. Testing & Validation:
 Changes are tested in a controlled environment before deployment.
3. Implementation:
 Changes are applied in production systems with minimal disruption.
4. Rollback Plan:
 If a change introduces errors, a rollback to the previous state should be
possible.
 Why It Matters:
 o Prevents unauthorized changes that could introduce vulnerabilities.
o Ensures system stability by avoiding unplanned downtime.
o Helps meet compliance requirements.

D. Patch Management

 Definition:
A patch is an update, upgrade, or modification to a system that fixes security
vulnerabilities or improves functionality.
 Challenges in Patch Management:
o Irregular patch releases from multiple vendors.
o Testing difficulties—some patches might break system functionality.
o Risk of failed patches, which can introduce new issues.
 Best Practices for Patch Management:

1. Prioritize Patches:
 Critical security patches should be deployed immediately.
 Less critical patches should be tested before rollout.
2. Test Before Deployment:
 Use a test environment to check for potential system failures.
3. Rollback Plan:
 Always have a strategy to revert changes if issues arise.
4. Automate Patch Management (When Possible):
 Some organizations use unattended patching solutions.
 However, automated patching can cause unexpected outages (e.g.,
system restarts).

 Compliance Considerations:
o Standards like PCI DSS mandate that security patches be deployed within a
specific time frame.

E. Verification & Audit

 Purpose:
o Ensures that applied changes match approved baselines.
o Detects unauthorized changes or security misconfigurations.
o Maintains system compliance with security policies.
 Key Verification Steps:

1. Regression Testing:
 Ensures that new updates do not break existing functionality.
2. Security Assessments:
 Evaluates whether the system remains secure after updates.
3. Audit Logs & Reviews:
 Tracks who made what changes, when, and why.
3. Why Configuration Management is Critical for Security
 Prevents unauthorized changes that could introduce vulnerabilities.
 Ensures system integrity by maintaining accurate records of modifications.
 Helps with compliance by proving that systems meet regulatory standards.
 Reduces downtime and risk by implementing controlled updates and rollbacks.

4. Key Takeaways
 Configuration Management ensures that only authorized changes occur in a
system.
 Baselines establish a security standard to measure all updates and patches against.
 Patch Management is critical but requires careful testing before deployment.
 Verification and auditing help maintain compliance and detect unauthorized
modifications.
 Automated patching is useful but can cause unexpected issues if not monitored
properly.

Common Security Policies

Overview
All security policies must support the regulatory and contractual obligations of the
organization. However, ensuring that policies encompass all necessary requirements while
remaining simple enough for users to understand can be challenging. Below are six common
security-related policies found in most organizations.

1. Data Handling Policy

This policy defines how data should be classified and handled:

 Specifies whether data is for internal use only, restricted to certain roles, or can be
made public.
 Includes legal usage definitions and regulatory requirements.
 Ensures proper data classification to comply with laws and regulations, such as PCI
DSS, HIPAA, and GDPR.
 Example: Credit card data classified as confidential must be encrypted to meet PCI
DSS requirements.

2. Password Policy
Every organization should have a password policy that:
  Establishes senior leadership's commitment to secure access.
 Defines password complexity requirements (length, character variety, expiration,
etc.).
 Identifies enforcement and validation mechanisms.
 Encourages the use of multi-factor authentication (MFA) where applicable.

3. Acceptable Use Policy (AUP)

This policy defines acceptable use of the organization’s network, systems, and devices:

 Outlines data access, system access, and data disclosure regulations.

 Includes rules on password security, data retention, internet usage, and company
device usage.
 Requires employees (or anyone with access) to sign the AUP, preferably witnessed by
another employee.

4. Bring Your Own Device (BYOD) Policy

Organizations may allow employees to use personal devices for work purposes. This policy:

 Defines allowed and restricted devices.

 Establishes security configurations to protect organizational data.
 Addresses challenges such as forensic audits, backdoors, and security vulnerabilities.
 Requires employees to acknowledge and comply with security guidelines for personal
devices.

5. Privacy Policy
This policy governs the handling of personally identifiable information (PII) and electronic
protected health information (ePHI):

 Defines what constitutes PII/ePHI and outlines handling procedures.

 Details enforcement mechanisms and consequences of non-compliance.
 References applicable regulations (e.g., GDPR, HIPAA, PIPEDA, GLBA).
 Provides transparency on how personal data is used internally and externally.

6. Change Management Policy

Change management ensures secure and controlled system modifications:

 Defines the process for transitioning from the current state to a future state.
 Consists of three major activities: deciding to change, implementing the change, and
verifying the change.
 Requires proper approvals before making alterations.
 Helps mitigate risks by preventing unauthorized or poorly executed changes.

Common Security Policies: Deeper Dive

Security policies should align with the organization's needs, vision, and mission. Each policy
should outline penalties or consequences for noncompliance, such as:

 First-time violations may result in a warning.

 Repeated offenses could lead to suspension or forced leave.
 Severe breaches may result in termination.

Enforcement and Employee Awareness

 Policies should be clearly outlined during onboarding, particularly for information

security personnel.
 Responsibilities for enforcing policies should be explicitly assigned.
 Employees must sign off on policies, with documentation confirming
acknowledgment.
 Training could include surveys or quizzes to ensure employees truly understand the
policies.
 Security and data handling procedures should always be backed by appropriate
policies.

Compliance Considerations
Organizations must align policies with national and international laws, such as:

 GDPR (EU) - Data protection and privacy regulations.

 PIPEDA (Canada) - Personal data handling laws.
 HIPAA (US) - Health information privacy.
 GLBA (US) - Financial data protection.
 Local and industry-specific laws applicable to the organization’s jurisdiction.

Conclusion
Effective security policies are essential for protecting an organization’s assets, maintaining
regulatory compliance, and ensuring clear expectations for all employees. Organizations must
review and update these policies regularly to address emerging security challenges and
technological advancements.

Change Management Components

Overview
The change management process ensures that modifications to systems, applications, and
infrastructure are carried out in a controlled and secure manner. It minimizes disruptions,
maintains compliance, and provides accountability.

Key Components
1. Request for Change (RFC)

 Any change begins with an RFC, which documents the nature, purpose, and potential
impact of the change.
 The RFC is evaluated for completeness and assigned to the appropriate change
authorization process.

2. Change Evaluation and Approval

 Changes are reviewed based on risk, organizational impact, and feasibility.

 Stakeholders provide input, and resources are identified and allocated.
 Changes are either approved or rejected, with documentation of the decision.

3. Change Implementation Process

Depending on the nature of the change, the following steps may be involved:
  Scheduling the change: Ensuring minimal disruption to operations.
 Testing the change: Verifying that it functions as expected.
 Rollback procedures: Preparing contingency plans if issues arise.
 Implementing the change: Executing modifications in the production environment.
 Evaluation: Assessing whether the change operates correctly.
 Documentation: Recording all actions for future reference.

4. Rollback Planning

 If monitoring indicates inadequate performance or unforeseen issues, rollback

authority must be clearly defined.
 The rollback plan might be executed immediately or scheduled as a subsequent
change.

Importance of Change Management

 Reduces risks associated with unauthorized or improperly executed modifications.
 Provides a structured framework for evaluating and implementing changes.
 Ensures that changes align with organizational objectives and security policies.

Change management is a fundamental process in IT governance, security, and compliance.

Organizations must have clear procedures to manage modifications efficiently while
mitigating risks.

Security Awareness Training

Overview
Security awareness training is a critical component of an organization's cybersecurity
framework. It ensures that employees understand security threats, best practices, and their
responsibilities in protecting sensitive information.

Purpose of Security Awareness Training

 Helps employees understand security expectations based on their roles and
responsibilities.
 Identifies and mitigates risks related to carelessness or complacency.
 Reinforces a culture of security within the organization.

Three Types of Learning Activities

1. Education

 Focuses on improving learners' understanding of security concepts.

  Encourages application of security knowledge in daily operations.

2. Training

 Develops proficiency in security-related skills and decision-making.

 Covers technical and procedural aspects of cybersecurity, such as recognizing
phishing emails or using multi-factor authentication.

3. Awareness

 Engages learners by highlighting security concerns, risks, and real-world threats.

 Targets broad audiences, ensuring all employees understand the importance of
security.

Importance of Security Awareness

 Prevents security breaches caused by human error.
 Strengthens the organization’s overall security posture.
 Ensures compliance with regulatory and industry standards.
 Helps executives and employees alike understand their role in maintaining security.

Organizations should incorporate security awareness training into onboarding and conduct
regular refresher sessions to keep employees informed about evolving security threats.

Security Awareness Training

Here’s an example of Security Awareness Training in practice:

1. Education Example
o Workers in a secure server room are taught about the interaction of fire and
smoke detectors, suppression systems, alarms, electrical power, lighting, and
ventilation systems.
o Selected users learn how social engineering attacks work and create defensive
strategies to counter them.
2. Training Example
o Workers receive detailed, task-specific training on how to respond to alarms,
system malfunctions, or suppression system failures.
o Employees practice identifying phishing emails through simulated attacks and
learn the proper steps to report them.
3. Awareness Example
o Signage, floor markings, and alarm indicators remind workers of emergency
actions in case of fire or system failure.
o Employees are regularly reminded of phishing, vishing, smishing, and other
social engineering threats through posters, email alerts, and simulated
exercises.

Password Protection
Password Managers & Risks

o Password managers help users store multiple passwords securely, eliminating

the need to remember them.
o The main risk is that if the password manager itself is compromised, all stored
credentials may be exposed.
o Weak master passwords or poor security practices can lead to breaches.
2. Best Practices for Secure Password Management
o Use unique passwords for different systems, avoiding reuse between personal
and work accounts.
o Implement a strong master password for password managers, ideally using a
passphrase.
o Enable multi-factor authentication (MFA) wherever possible for added
security.
o Organizations should recommend secure password management solutions
to users.
3. Common Password Mistakes to Avoid
o Reusing passwords across multiple systems, especially mixing personal and
business credentials.
o Writing down passwords and storing them in unsecured locations.
o Sharing passwords with coworkers, tech support, or unauthorized individuals.

Hashing

What is Hashing?

Hashing is a process that takes an input of arbitrary size and transforms it into a fixed-length
output known as a hash value or digest. This transformation is performed using a hash
function, which is an algorithm designed to maintain data integrity.

Key Properties of a Cryptographic Hash Function

A secure hash function must demonstrate the following properties:

1. Easy to Compute – The hash value can be quickly generated for any given input.
2. Non-Reversible – It is computationally infeasible to reconstruct the original input
from its hash. Unlike encryption, hashing does not have a decryption process.
3. Integrity Assurance – Any modification to the input results in a completely different
hash, making it impossible to tamper with the data unnoticed.
4. Collision-Resistant – Two different inputs should not produce the same hash value
(i.e., no hash collisions).
5. Deterministic – The same input always generates the same hash when using the same
algorithm.

Common Uses of Hashing in Security

  Message Integrity Verification – Ensuring that transmitted or stored messages
remain unaltered.
 Digital Signatures – Hashing is used in cryptographic signatures to verify
authenticity.
 Authentication – Securely storing and verifying passwords (e.g., storing hashed
passwords instead of plaintext).
 Data Deduplication – Identifying duplicate files or records using unique hashes.
 Checksums – Detecting accidental corruption in transmitted data.

Example of Hashing in Action

1. A sender generates a hash of a message before transmission.

2. The recipient receives both the message and its hash.
3. The recipient hashes the received message and compares it with the sender’s hash.
4. If the hash values match, the message has not been altered; otherwise, the data has
been tampered with.

Why Hashing Alone is Not Enough?

Although hashing helps maintain integrity, it does not prevent man-in-the-middle attacks,
where an attacker can alter both the message and its hash. To ensure security, cryptographic
techniques such as HMAC (Hash-based Message Authentication Code) or digital
signatures should be used.

Hashing Deep Dive

Ensuring Data Integrity with Hashing

Before deploying software from a third-party vendor, it’s crucial to verify that the code has
not been altered since testing. Developers often provide a hash digest (also known as a
checksum) that can be compared to the original to confirm integrity.

How Hashing Works

Hashing applies a mathematical algorithm to data, producing a fixed-length alphanumeric

digest that represents the input.

 Regardless of input size, the output (hash) remains a fixed length.

 Even the smallest modification to the input—such as changing a lowercase letter to
uppercase—completely alters the hash.
 This property allows hashes to serve as digital fingerprints for files, passwords, and
transactions.

Common Hashing Algorithms

Different cryptographic hash algorithms serve various security purposes. Here are some
widely used ones:

1. SHA (Secure Hash Algorithm)

  SHA-1: Once widely used, but now considered weak due to collision attacks.
 SHA-256: Part of the SHA-2 family, this is highly secure and commonly used in
blockchain, digital signatures, and SSL/TLS encryption.
 SHA-3: A newer version that enhances security further but is less widely adopted.

2. MD5 (Message Digest Algorithm 5) – Weak for Security

 Produces a 128-bit hash value.

 Fast but insecure—prone to collision attacks, making it unsuitable for cryptographic
security.
 Still used for file integrity checks in non-secure environments.

3. Bcrypt – Designed for Password Hashing

 Unlike SHA, Bcrypt incorporates a salt to protect against rainbow table attacks.
 Slow and computationally expensive, making it resistant to brute force attacks.
 Commonly used for storing passwords securely.

4. Argon2 – Modern Password Hashing Standard

 Winner of the Password Hashing Competition (PHC).

 Highly resistant to GPU and FPGA-based brute-force attacks.
 Recommended for modern password storage in secure applications.

Real-World Cybersecurity Attacks on Hashing

1. Collision Attacks (SHA-1 and MD5 Vulnerability)

 A collision occurs when two different inputs produce the same hash output.
 Example: In 2017, Google demonstrated a collision attack on SHA-1 by generating
two different PDFs with the same SHA-1 hash.
 Impact: Attackers could create malicious files that appear identical to legitimate ones
when hashed, allowing malware injection in trusted environments.

2. Rainbow Table Attacks (Password Cracking)

 Attackers use precomputed hash tables to crack weakly hashed passwords without
brute-forcing each attempt.
 Solution: Use salted hashes (e.g., Bcrypt, Argon2) to make precomputed attacks
ineffective.

3. Man-in-the-Middle (MITM) Hash Tampering

 If a website does not use proper encryption and integrity checking, an attacker can
alter the transmitted hash and file before it reaches the recipient.
 Example: If you download software from a compromised server, an attacker could
modify both the installer and its hash, making it appear untampered.
  Solution: Always verify hashes from multiple trusted sources or use digital
signatures for added authenticity.

4. Length Extension Attacks

 Some weak hash functions allow an attacker to append extra data to an existing hash
without knowing the original input.
 Example: If an application relies on SHA-1 for authentication, an attacker could
exploit this weakness to forge valid credentials.
 Solution: Use HMAC (Hashed Message Authentication Code) instead of raw hash
functions for security-critical applications.

Real-World Application: Fraud Prevention

Imagine you pay $5,000 in rent via automatic withdrawal. If someone maliciously alters the
transaction to $50,000, the resulting hash will be entirely different.

 The discrepancy in the hash value alerts the system that the data has changed.
 Security analysts can then compare the original and altered versions to identify
unauthorized modifications.

Hashing in Software Distribution

Hashing is critical for software integrity checks. A famous incident at the University of
Florida involved distributing Windows 2000/Millennium CDs to 50,000 students. The
hash digests for some files did not match, revealing that the software had been tampered
with before distribution.

Conclusion

Hashing serves as an extra layer of security, ensuring that data integrity is maintained in
various applications, from software verification to financial transactions. While automated
tools help detect hash mismatches, in complex cases, security teams may have to conduct
manual reviews to pinpoint unauthorized changes.

Phishing: The Silent Cyber Threat

Phishing attacks continue to be one of the most dangerous cybersecurity threats. Attackers
impersonate trusted entities to trick individuals into revealing sensitive information, such
as passwords, credit card details, or corporate credentials.

Common Phishing Techniques

1. Email Phishing

 Most common method: Attackers send fraudulent emails that appear legitimate.
  Example: A fake PayPal email urging the recipient to "verify your account" by
clicking a malicious link.

2. Spear Phishing

 Targeted attack: The attacker customizes emails for specific individuals based on
their job, social media activity, or known connections.
 Example: Hackers researching an executive’s LinkedIn profile to craft a believable
email from a "colleague" requesting a document review.

3. Whaling (CEO Fraud)

 Targets high-ranking officials (executives, directors, financial officers).

 Goal: Trick them into authorizing large fund transfers or disclosing classified
company data.
 Real-World Case:
o In 2016, attackers spoofed an email from the CEO of Snapchat, tricking an
employee into sharing payroll data.

4. Vishing (Voice Phishing)

 Phone-based phishing attack, often posing as tech support, government agents, or

bank representatives.
 Example: Fake calls from “Microsoft Support” claiming your computer has a virus
and requesting remote access.

5. Smishing (SMS Phishing)

 Attack via SMS or WhatsApp messages with malicious links or fake urgent
requests.
 Example: "Your bank account is locked. Click here to unlock it."

6. Clone Phishing

 Attackers clone a legitimate email and resend it with a malicious attachment or

link.
 Example: A real email from HR is cloned and resent, tricking employees into
opening a malicious document.

Real-World Cyberattacks Involving Phishing

1. The 2016 DNC Hack

 Attackers used spear phishing emails to trick Democratic National Committee

members into revealing passwords.
 Result: Hackers gained access to confidential election campaign data.
2. Google & Facebook Scam ($100 Million Loss)

 A hacker impersonated a supplier and sent fake invoices to both companies.

 Over several years, both tech giants unknowingly transferred $100 million before
discovering the fraud.

3. 2020 Twitter Breach

 Attackers phished Twitter employees for login credentials.

 Took over accounts of Elon Musk, Bill Gates, and Apple to promote a Bitcoin
scam.

How to Protect Against Phishing Attacks

✅ Verify URLs Before Clicking: Always hover over links to check the real destination
before clicking.

✅ Multi-Factor Authentication (MFA): Even if a password is stolen, MFA adds an extra

layer of security.

✅ Check Email Headers & Sender Info: Phishing emails often have subtle spelling errors
in sender addresses (e.g., "[Link]" instead of "[Link]").

✅ Never Share Sensitive Info Over Phone or Email: Banks and tech companies never
request credentials via email or call.

✅ Use Anti-Phishing Software: Organizations should deploy email filtering systems and
browser protection tools to block phishing attempts.

✅ Cybersecurity Awareness Training: Regular phishing simulations help employees

identify and avoid scams.

Symmetric Encryption: The Core of Fast and

Efficient Data Protection
What is Symmetric Encryption?

Symmetric encryption is a cryptographic method that uses the same key for both encryption
and decryption. The decryption process is essentially the mirror image of the encryption
process, ensuring that only those with the correct key can access the original data.

How Symmetric Encryption Works

 1. Encryption: The sender encrypts plaintext using a secret key to generate ciphertext.
2. Transmission: The encrypted message is transmitted to the recipient.
3. Decryption: The recipient decrypts the ciphertext using the same secret key to
recover the plaintext.

This method is widely used for securing large volumes of data efficiently.

Key Characteristics of Symmetric Encryption

 Same key used for encryption and decryption

 Fast and efficient for large data volumes
 Requires secure key distribution between communicating parties
 Prone to key management challenges in large networks

Popular Symmetric Encryption Algorithms

🔐 AES (Advanced Encryption Standard)

 Most widely used symmetric algorithm

 Key sizes: 128-bit, 192-bit, 256-bit
 Used in SSL/TLS, VPNs, and secure file storage

🔐 DES (Data Encryption Standard)

 Older algorithm with a 56-bit key (now considered weak)

 Replaced by AES due to security vulnerabilities

🔐 3DES (Triple DES)

 Applies DES encryption three times for improved security

 Still used in legacy systems but being phased out

🔐 Blowfish & Twofish

 Flexible key lengths (32-448 bits for Blowfish, 128-256 bits for Twofish)
 Used in encryption software like TrueCrypt and some VPN protocols

Primary Uses of Symmetric Encryption

✅ Encrypting bulk data:

 Hard drives, database records, portable media storage

✅ Secure communication:

 IPsec, TLS, Wi-Fi encryption (WPA2, WPA3)

✅ Streaming data encryption:

  Secure video/audio transmission, online gaming

Challenges of Symmetric Encryption

⚠ Key Distribution Issues

 The secret key must be securely shared between parties before communication.
 If intercepted during exchange, the encryption is compromised.

⚠ Scalability Challenges

 In a large organization, the number of required keys increases exponentially.

 Example: A company with 1,000 employees would need 499,500 unique keys to
allow secure communication between all employees.

⚠ Man-in-the-Middle (MITM) Attacks

 If an attacker intercepts the key exchange, they can decrypt and manipulate
communications.
 Solution: Secure key exchange mechanisms like Diffie-Hellman or using asymmetric
encryption to transmit symmetric keys.

Comparison: Symmetric vs. Asymmetric Encryption

Feature Symmetric Encryption Asymmetric Encryption

Same key for encryption &
Key Usage Different keys (public & private)
decryption
Speed Faster (suitable for large data) Slower (computationally intensive)
Key
Requires secure key exchange Public keys can be shared openly
Management
Higher security, especially for
Security Level Secure if the key is protected
authentication
Common Uses Bulk encryption, streaming data Digital signatures, secure key exchange

Conclusion

Symmetric encryption remains a cornerstone of modern cybersecurity due to its speed and
efficiency. However, challenges related to key distribution and scalability must be addressed
with proper security measures. In many applications, symmetric encryption is combined with
asymmetric encryption for enhanced security, ensuring safe key exchange while leveraging
the speed of symmetric cryptography for actual data encryption.

Asymmetric Encryption: The Foundation of Secure

Communication
Unlike symmetric encryption, which uses the same key for both encryption and decryption,
asymmetric encryption uses a pair of keys:

 Public Key (shared openly)

 Private Key (kept secret)

This method is fundamental in cybersecurity, securing everything from online banking to

digital signatures.

How Asymmetric Encryption Works

🔹 Encryption Process:
1️⃣ Sender encrypts a message using the recipient’s public key.
2️⃣ Only the recipient’s private key can decrypt the message.

🔹 Digital Signatures (Authentication & Integrity):

1️⃣ Sender signs the message with their private key.
2️⃣ The recipient verifies the signature using the sender’s public key.

🔹 Key Advantage: No need to exchange secret keys before communication.

Popular Asymmetric Encryption Algorithms

🔐 RSA (Rivest-Shamir-Adleman)

 Most widely used (e.g., SSL/TLS, PGP, VPNs).

 Keys: 1024-bit to 4096-bit.
 Slower for large data encryption.

🔐 ECC (Elliptic Curve Cryptography)

 Stronger security with smaller keys (256-bit ECC ≈ 3072-bit RSA).

 Used in modern cryptographic protocols (e.g., Signal, Bitcoin).

🔐 Diffie-Hellman (DH) Key Exchange

 Used for secure key exchange (not direct encryption).

 Found in VPNs & TLS handshake.

🔐 DSA (Digital Signature Algorithm)

 Used for digital signatures in documents and software verification.

Real-World Applications of Asymmetric Encryption
✅ TLS/SSL (Securing Websites & HTTPS)

 Encrypts communication between browsers and web servers.

✅ Email Security (PGP & S/MIME)

 PGP (Pretty Good Privacy) encrypts emails using public-key cryptography.

 S/MIME (Secure/Multipurpose Internet Mail Extensions) secures corporate
emails.

✅ Secure Messaging Apps (WhatsApp, Signal)

 End-to-end encryption via Diffie-Hellman key exchange & ECC.

✅ Cryptocurrency & Blockchain (Bitcoin, Ethereum)

 Wallets use ECC to generate public/private key pairs.

✅ Digital Signatures & Code Signing

 Software developers sign applications to prove authenticity (e.g., Microsoft, Apple).

✅ VPNs & SSH Authentication

 Secure remote access via RSA key pairs.

Limitations of Asymmetric Encryption

⚡ Slower than Symmetric Encryption

 Computationally intensive (RSA-2048 ≈ 1000x slower than AES-256).

⚡ Vulnerable to Quantum Computing

 Quantum attacks (Shor’s algorithm) can break RSA & ECC encryption.

⚡ Key Management Complexity

 Private keys must be securely stored to prevent breaches.

Social Engineering: The Art of Human Exploitation

in Cybersecurity
What is Social Engineering?

Social engineering is a psychological manipulation technique used by attackers to deceive

individuals into divulging confidential information or performing actions that compromise
security. Instead of exploiting software vulnerabilities, attackers exploit human trust,
curiosity, and urgency.

How Social Engineering Works

Social engineering attacks typically follow these steps:

1. Research: The attacker gathers information about the target (e.g., job role, personal
details, organizational structure).
2. Engagement: The attacker establishes contact through email, phone, social media, or
in person.
3. Deception: The victim is tricked into revealing sensitive information or performing a
risky action.
4. Execution: The attacker gains unauthorized access, installs malware, or steals
valuable data.

Common Social Engineering Techniques

🔹 Phishing

 Fraudulent emails or messages pretending to be from trusted entities (banks, IT

departments, colleagues).
 Aim: Steal login credentials, credit card details, or install malware.

🔹 Spear Phishing

 A targeted phishing attack aimed at a specific individual or organization.

 More convincing because it uses personal details gathered from research.

🔹 Vishing (Voice Phishing)

 Attackers use phone calls to impersonate officials (banks, IT support, HR

departments).
 Aim: Trick victims into sharing sensitive information or granting remote access.

🔹 Smishing (SMS Phishing)

 Fraudulent text messages urging recipients to click malicious links or provide

sensitive details.

🔹 Pretexting

 Attackers create a fabricated scenario to obtain personal information (e.g., pretending

to be a police officer, IT support, or company executive).
🔹 Baiting

 Attackers leave an infected USB drive or link disguised as free software, hoping
victims will access it.

🔹 Quid Pro Quo

 Offering a service or benefit in exchange for confidential data (e.g., fake tech support
asking for login credentials).

🔹 Tailgating (Piggybacking)

 Unauthorized persons gaining access to restricted areas by following authorized

personnel (e.g., asking someone to hold the door open).

Real-World Examples of Social Engineering Attacks

✅ Business Email Compromise (BEC)

 Attackers impersonate executives or vendors to trick employees into wiring money or

sharing sensitive data.

✅ Tech Support Scams

 Fake IT support representatives convince users to install malware or share login

credentials.

✅ COVID-19 Scams

 Attackers exploited pandemic-related fears with fake donation sites, phishing emails,
and fraudulent health information.

✅ Deepfake Attacks

 AI-generated fake videos or voice recordings used to impersonate executives and

authorize fraudulent transactions.

Preventing Social Engineering Attacks

🛡 Employee Awareness & Training

 Regular security awareness training to recognize social engineering tactics.

 Simulated phishing exercises to test employee vigilance.

🛡 Verify Requests

 Always verify unexpected requests for sensitive information or urgent actions via a
separate communication channel.
🛡 Use Multi-Factor Authentication (MFA)

 Even if credentials are stolen, MFA adds an extra layer of protection.

🛡 Implement Strong Security Policies

 Restrict access to sensitive information.

 Require employees to change passwords regularly.

🛡 Secure Physical Access

 Implement badge access controls.

 Train employees to challenge unauthorized individuals.

Conclusion

Social engineering remains one of the most effective tactics for cybercriminals. Since it preys
on human psychology rather than technical vulnerabilities, education and awareness are the
best defenses. Organizations must cultivate a security-first culture where employees remain
vigilant and cautious in all interactions, whether online, over the phone, or in person.

Glossary A - C

 Adequate Security: Security

commensurate with the risk and the
magnitude of harm resulting from
the loss, misuse or unauthorized
access to or modification of
information. Source: OMB Circular
A-130

 Administrative Controls: Controls

implemented through policy and
procedures. Examples include
 access control processes and
requiring multiple personnel to
conduct a specific operation.
Administrative controls in modern
environments are often enforced in
conjunction with physical and/or
technical controls, such as an
access-granting policy for new users
that requires login and approval by
the hiring manager.

 Adverse Events: Events with a

negative consequence, such as
system crashes, network packet
floods, unauthorized use of system
privileges, defacement of a web
page or execution of malicious code
that destroys data.

 Application Programming Interface

(API): A set of routines, standards,
protocols, and tools for building
software applications to access a
web-based software application or
 web tool.

 Application Server: A computer

responsible for hosting applications
to user workstations. NIST SP 800-
82 Rev.2

 Artificial Intelligence: The ability of

computers and robots to simulate
human intelligence and behavior.

 Asset: Anything of value that is

owned by an organization. Assets
include both tangible items such as
information systems and physical
property and intangible assets such
as intellectual property.

 Asymmetric Encryption: An
algorithm that uses one key to
encrypt and a different key to
decrypt the input plaintext.
 Audit: Independent review and
examination of records and
activities to assess the adequacy of
system controls, to ensure
compliance with established policies
and operational procedures. NIST
SP 1800-15B

 Authentication: The act of

identifying or verifying the
eligibility of a station, originator, or
individual to access specific
categories of information. Typically,
a measure designed to protect
against fraudulent transmissions by
establishing the validity of a
transmission, message, station or
originator.

 Authorization: The right or a

permission that is granted to a
system entity to access a system
resource. NIST 800-82 Rev.2
 Availability: Ensuring timely and
reliable access to and use of
information by authorized users.

 Baseline: A documented, lowest

level of security configuration
allowed by a standard or
organization.

 Biometric: Biological characteristics

of an individual, such as a
fingerprint, hand geometry, voice,
or iris patterns.

 Bit: The most essential

representation of data (zero or one)
at Layer 1 of the Open Systems
Interconnection (OSI) model.

 Bot: Malicious code that acts like a

remotely controlled “robot” for an
attacker, with other Trojan and
worm capabilities.
 Breach: The loss of control,
compromise, unauthorized
disclosure, unauthorized acquisition
or any similar occurrence where: a
person other than an authorized
user accesses or potentially
accesses personally identifiable
information; or an authorized user
accesses personally identifiable
information for other than an
authorized purpose. Source: NIST
SP 800-53 Rev. 5

 Broadcast: Broadcast transmission

is a one-to-many (one-to-everyone)
form of sending internet traffic.

 Business Continuity (BC): Actions,

processes and tools for ensuring an
organization can continue critical
operations during a contingency.

 Business Continuity Plan (BCP): The

documentation of a predetermined
set of instructions or procedures
 that describe how an organization’s
mission/business processes will be
sustained during and after a
significant disruption.

 Business Impact Analysis (BIA): An

analysis of an information system’s
requirements, functions, and
interdependencies used to
characterize system contingency
requirements and priorities in the
event of a significant disruption.
NIST SP 800-34 Rev. 1

 Byte: The byte is a unit of digital

information that most commonly
consists of eight bits.

 Checksum: A digit representing the

sum of the correct digits in a piece
of stored or transmitted digital
data, against which later
comparisons can be made to detect
errors in the data.
 Ciphertext: The altered form of a
plaintext message so it is
unreadable for anyone except the
intended recipients. In other words,
it has been turned into a secret.

 Classification: Classification
identifies the degree of harm to the
organization, its stakeholders or
others that might result if an
information asset is divulged to an
unauthorized person, process or
organization. In short, classification
is focused first and foremost on
maintaining the confidentiality of
the data, based on the data
sensitivity.

 Classified or Sensitive
Information: Information that has
been determined to require
protection against unauthorized
disclosure and is marked to indicate
its classified status and
classification level when in
 documentary form.

 Cloud Computing: A model for

enabling ubiquitous, convenient,
on-demand network access to a
shared pool of configurable
computing resources (e.g.,
networks, servers, storage,
applications, and services) that can
be rapidly provisioned and released
with minimal management effort or
service provider interaction. NIST
800-145

 Community Cloud: A system in

which the cloud infrastructure is
provisioned for exclusive use by a
specific community of consumers
from organizations that have shared
concerns (e.g., mission, security
requirements, policy and
compliance considerations). It may
be owned, managed and operated
by one or more of the organizations
in the community, a third party or
 some combination of them, and it
may exist on or off premises. NIST
800-145

 Confidentiality: The characteristic of

data or information when it is not
made available or disclosed to
unauthorized persons or processes.
NIST 800-66

 Configuration Management: A
process and discipline used to
ensure that the only changes made
to a system are those that have
been authorized and validated.

 Crime Prevention through

Environmental Design (CPTED): An
architectural approach to the design
of buildings and spaces that
emphasizes passive features to
reduce the likelihood of criminal
activity.
 Criticality: A measure of the degree
to which an organization depends
on the information or information
system for the success of a mission
or of a business function. NIST SP
800-60 Vol. 1, Rev. 1

 Cryptanalyst: One who performs

cryptanalysis, which is the study of
mathematical techniques for
attempting to defeat cryptographic
techniques and/or information
systems security. This includes the
process of looking for errors or
weaknesses in the implementation
of an algorithm or of the algorithm
itself.

 Cryptography: The study or

applications of methods to secure or
protect the meaning and content of
messages, files, or other
information, usually by disguise,
obscuration, or other
 transformations of that content and
meaning.
 Data Integrity: The property that
data has not been altered in an
unauthorized manner. Data
integrity covers data in storage,
during processing and while in
transit. Source: NIST SP 800-27 Rev
A

 Data Loss Prevention (DLP): System

capabilities designed to detect and
prevent the unauthorized use and
transmission of information.

 Decryption: The reverse process

from encryption. It is the process of
converting a ciphertext message
back into plaintext through the use
of the cryptographic algorithm and
the appropriate key for decryption
(which is the same for symmetric
encryption, but different for
asymmetric encryption). This term
is also used interchangeably with
 “deciphering.”

 De-encapsulation: The opposite

process of encapsulation, in which
bundles of data are unpacked or
revealed.

 Defense in Depth: Information

security strategy integrating
people, technology, and operations
capabilities to establish variable
barriers across multiple layers and
missions of the organization.
Source: NIST SP 800-53 Rev 4

 Degaussing: A technique of erasing

data on disk or tape (including
video tapes) that, when performed
properly, ensures that there is
insufficient magnetic remanence to
reconstruct data.

 Denial-of-Service (DoS): The

prevention of authorized access to
resources or the delaying of time-
 critical operations. (Time-critical
may be milliseconds or it may be
hours, depending upon the service
provided.) Source: NIST SP 800-27
Rev A

 Digital Signature: The result of a

cryptographic transformation of
data which, when properly
implemented, provides the services
of origin authentication, data
integrity, and signer non-
repudiation. NIST SP 800-12 Rev. 1

 Disaster Recovery (DR): In

information systems terms, the
activities necessary to restore IT
and communications services to an
organization during and after an
outage, disruption or disturbance of
any kind or scale.

 Disaster Recovery Plan (DRP): The

processes, policies and procedures
related to preparing for recovery or
 continuation of an organization's
critical business functions,
technology infrastructure, systems
and applications after the
organization experiences a disaster.
A disaster is when an organization’s
critical business function(s) cannot
be performed at an acceptable level
within a predetermined period
following a disruption.

 Discretionary Access Control

(DAC): A certain amount of access
control is left to the discretion of
the object’s owner, or anyone else
who is authorized to control the
object’s access. The owner can
determine who should have access
rights to an object and what those
rights should be. NIST SP 800-192

 Domain Name Service (DNS): This

acronym can be applied to three
interrelated elements: a service, a
physical server and a network
 protocol.

 Egress Monitoring: Monitoring of

outgoing network traffic.

Encapsulation: Enforcement of data

hiding and code hiding during all
phases of software development
and operational use. Bundling
together data and methods is the
process of encapsulation; its
opposite process may be called
unpacking, revealing, or using other
terms. Also used to refer to taking
any set of data and packaging it or
hiding it in another data structure,
as is common in network protocols
and encryption.

 Encrypt: To protect private

information by putting it into a form
that can only be read by people who
have permission to do so.
 Encryption: The process and act of
converting the message from its
plaintext to ciphertext. Sometimes
it is also referred to as enciphering.
The two terms are sometimes used
interchangeably in literature and
have similar meanings.

 Encryption System: The total set of

algorithms, processes, hardware,
software and procedures that taken
together provide an encryption and
decryption capability.

 Event: Any observable occurrence in

a network or system. Source: NIST
SP 800-61 Rev 2

 Exploit: A particular attack. It is

named this way because these
attacks exploit system
vulnerabilities.

 File Transfer Protocol (FTP): The

internet protocol (and program)
 used to transfer files between
hosts.

 Firewalls: Devices that enforce

administrative security policies by
filtering incoming traffic based on a
set of rules.

 Fragment Attack: In a fragment

attack, an attacker fragments traffic
in such a way that a system is
unable to put data packets back
together.

 General Data Protection Regulation

(GDPR): In 2016, the European
Union passed comprehensive
legislation that addresses personal
privacy, deeming it an individual
human right.

 Governance: The process of how an

organization is managed; usually
includes all aspects of how
decisions are made for that
 organization, such as policies, roles
and procedures.
 Impact: The magnitude of harm that
could be caused by a threat’s
exercise of a vulnerability.

 Incident: An event that actually or

potentially jeopardizes the
confidentiality, integrity or
availability of an information
system or the information the
system processes, stores or
transmits.

 Incident Handling or Incident

Response (IR): The process of
detecting and analyzing incidents to
limit the incident's effect.

 Incident Response Plan (IRP): The

documentation of a predetermined
set of instructions or procedures to
detect, respond to and limit
consequences of a malicious
cyberattack against an
 organization’s information
systems(s). Source: NIST SP 800-34
Rev 1

 Information Security Risk: The

potential adverse impacts to an
organization’s operations (including
its mission, functions and image
and reputation), assets, individuals,
other organizations, and even the
nation, which results from the
possibility of unauthorized access,
use, disclosure, disruption,
modification or destruction of
information and/or information
systems.

 Infrastructure as a Service
(IaaS): The provider of the core
computing, storage and network
hardware and software that is the
foundation upon which
organizations can build and then
deploy applications. IaaS is popular
in the data center where software
 and servers are purchased as a fully
outsourced service and usually
billed on usage and how much of
the resource is used.

 Ingress Monitoring: Monitoring of

incoming network traffic.

 Insider Threat: An entity with

authorized access that has the
potential to harm an information
system through destruction,
disclosure, modification of data,
and/or denial of service. NIST SP
800-32

 Institute of Electrical and

Electronics Engineers (IEEE): IEEE is
a professional organization that
sets standards for
telecommunications, computer
engineering and similar disciplines.

 Integrity: The property of

information whereby it is recorded,
 used and maintained in a way that
ensures its completeness, accuracy,
internal consistency and usefulness
for a stated purpose.

 International Organization of
Standards (ISO): The ISO develops
voluntary international standards in
collaboration with its partners in
international standardization, the
International Electro-technical
Commission (IEC) and the
International Telecommunication
Union (ITU), particularly in the field
of information and communication
technologies.

 Internet Control Message Protocol

(ICMP): An IP network protocol
standardized by the Internet
Engineering Task Force (IETF)
through RFC 792 to determine if a
particular service or host is
available.
 Internet Engineering Task Force
(IETF): The internet standards
organization, made up of network
designers, operators, vendors and
researchers, that defines protocol
standards (e.g., IP, TCP, DNS)
through a process of collaboration
and consensus. Source: NIST SP
1800-16B

 Internet Protocol (IPv4): Standard

protocol for transmission of data
from source to destinations in
packet-switched communications
networks and interconnected
systems of such networks. CNSSI
4009-2015

 Intrusion: A security event, or

combination of security events, that
constitutes a security incident in
which an intruder gains, or
attempts to gain, access to a
system or system resource without
authorization. Source: IETF RFC 4949
 Ver 2

 iOS: An operating system

manufactured by Apple Inc. Used for
mobile devices.

 Layered Defense: The use of

multiple controls arranged in series
to provide several consecutive
controls to protect an asset; also
called defense in depth.

 Likelihood: The probability that a

potential vulnerability may be
exercised within the construct of
the associated threat environment.

 Likelihood of Occurrence: A
weighted factor based on a
subjective analysis of the
probability that a given threat is
capable of exploiting a given
vulnerability or set of
vulnerabilities.
 Linux: An operating system that is
open source, making its source code
legally available to end users.

 Log Anomaly: A system irregularity

that is identified when studying log
entries which could represent
events of interest for further
surveillance.

 Logging: Collecting and storing user

activities in a log, which is a record
of the events occurring within an
organization’s systems and
networks. NIST SP 1800-25B.

 Logical Access Control Systems: An

automated system that controls an
individual’s ability to access one or
more computer system resources,
such as a workstation, network,
application or database. A logical
access control system requires the
validation of an individual’s identity
through some mechanism, such as a
 PIN, card, biometric or other token.
It has the capability to assign
different access privileges to
different individuals depending on
their roles and responsibilities in an
organization. NIST SP 800-53 Rev.5.
 Man-in-the-Middle: An attack where
the adversary positions himself in
between the user and the system so
that he can intercept and alter data
traveling between them. Source:
NISTIR 7711

 Mandatory Access Control - Access

control that requires the system
itself to manage access controls in
accordance with the organization’s
security policies.

 Mantrap - An entrance to a building

or an area that requires people to
pass through two doors with only
one door opened at a time.
 Message Digest - A digital signature
that uniquely identifies data and
has the property such that changing
a single bit in the data will cause a
completely different message digest
to be generated. NISTIR-8011 Vol.3

 Microsegmentation - Part of a zero-

trust strategy that breaks LANs into
very small, highly localized zones
using firewalls or similar
technologies. At the limit, this
places a firewall at every connection
point.

 Multi-Factor Authentication - Using

two or more distinct instances of
the three factors of authentication
(something you know, something
you have, something you are) for
identity verification.

 National Institutes of Standards and

Technology (NIST) - The NIST is part
of the U.S. Department of
 Commerce and addresses the
measurement infrastructure within
science and technology efforts
within the U.S. federal government.
NIST sets standards in a number of
areas, including information
security within the Computer
Security Resource Center of the
Computer Security Divisions.

 Non-repudiation - The inability to

deny taking an action such as
creating information, approving
information and sending or
receiving a message.

 Object - Passive information

system-related entity (e.g., devices,
files, records, tables, processes,
programs, domains) containing or
receiving information. Access to an
object (by a subject) implies access
to the information it contains. See
subject. Source: NIST SP 800-53 Rev
 4

 Operating System - The software

“master control application” that
runs the computer. It is the first
program loaded when the computer
is turned on, and its main
component, the kernel, resides in
memory at all times. The operating
system sets the standards for all
application programs (such as the
Web server) that run in the
computer. The applications
communicate with the operating
system for most user interface and
file management operations. NIST
SP 800-44 Version 2

 Oversized Packet Attack - Purposely

sending a network packet that is
larger than expected or larger than
can be handled by the receiving
system, causing the receiving
system to fail unexpectedly.
 Packet - Representation of data at
Layer 3 of the Open Systems
Interconnection (OSI) model.

 Patch - A software component that,

when installed, directly modifies
files or device settings related to a
different software component
without changing the version
number or release details for the
related software component.
Source: ISO/IEC 19770-2

 Patch Management - The systematic

notification, identification,
deployment, installation and
verification of operating system and
application software code revisions.
These revisions are known as
patches, hotfixes, and service
packs. Source: CNSSI 4009
 Payload - The primary action of a
malicious code attack.
 Payment Card Industry Data
Security Standard (PCI DSS) - An
information security standard
administered by the Payment Card
Industry Security Standards Council
that applies to merchants and
service providers who process
credit or debit card transactions.

 Personally Identifiable Information

(PII) - The National Institute of
Standards and Technology, known
as NIST, in its Special Publication
800-122 defines PII as “any
information about an individual
maintained by an agency, including
(1) any information that can be used
to distinguish or trace an
individual’s identity, such as name,
Social Security number, date and
place of birth, mother’s maiden
name, or biometric records; and (2)
any other information that is linked
or linkable to an individual, such as
medical, educational, financial and
 employment information.”

 Physical Controls - Controls

implemented through a tangible
mechanism. Examples include walls,
fences, guards, locks, etc. In
modern organizations, many
physical control systems are linked
to technical/logical systems, such as
badge readers connected to door
locks. Also known as Physical
Access Controls.

 Plaintext - A message or data in its

natural format and in readable
form; extremely vulnerable from a
confidentiality perspective.

 Platform as a Service (PaaS) - The

web-authoring or application
development middleware
environment that allows
applications to be built in the cloud
before they’re deployed as SaaS
 assets.

 Privacy - The right of an individual

to control the distribution of
information about themselves.

 Private Cloud - A cloud computing

platform that is implemented within
the corporate firewall, under the
control of the IT department. A
private cloud is designed to offer
the same features and benefits of
cloud systems but removes a
number of objections to the cloud
computing model, including control
over enterprise and customer data,
worries about security, and issues
connected to regulatory compliance.

 Principle of Least Privilege - The

principle that users and programs
should have only the minimum
privileges necessary to complete
their tasks. NIST SP 800-179
 Privileged Account - An information
system account with approved
authorizations of a privileged user.
NIST SP 800-53 Rev. 4

 Probability - The chances, or

likelihood, that a given threat is
capable of exploiting a given
vulnerability or a set of
vulnerabilities. Source: NIST SP 800-
30 Rev. 1

 Protected Health Information

(PHI) - Information regarding health
status, the provision of healthcare
or payment for healthcare as
defined in HIPAA (Health Insurance
Portability and Accountability Act).

 Protocols - A set of rules (formats

and procedures) to implement and
control some type of association
(that is, communication) between
systems. NIST SP 800-82 Rev. 2
 Public Cloud - The cloud
infrastructure is provisioned for
open use by the general public. It
may be owned, managed, and
operated by a business, academic,
or government organization, or
some combination of them. It exists
on the premises of the cloud
provider. NIST SP 800-145
 Qualitative Risk Analysis: A method
for risk analysis that is based on the
assignment of a descriptor such as
low, medium or high. Source: NISTIR
8286

 Quantitative Risk Analysis - A

method for risk analysis where
numerical values are assigned to
both impact and likelihood based on
statistical probabilities and
monetarized valuation of loss or
gain. Source: NISTIR 8286

 Ransomware - A type of malicious

software that locks the computer
 screen or files, thus preventing or
limiting a user from accessing their
system and data until money is
paid.

 Records - The recordings

(automated and/or manual) of
evidence of activities performed or
results achieved (e.g., forms,
reports, test results), which serve
as a basis for verifying that the
organization and the information
system are performing as intended.
Also used to refer to units of related
data fields (i.e., groups of data
fields that can be accessed by a
program and that contain the
complete set of information on
particular items). NIST SP 800-53
Rev. 4

 Records Retention - A practice

based on the records life cycle,
according to which records are
retained as long as necessary, and
 then are destroyed after the
appropriate time interval has
elapsed.

 Remanence - Residual information

remaining on storage media after
clearing. NIST SP 800-88 Rev. 1

 Request for Change (RFC) - The first

stage of change management,
wherein a change in procedure or
product is sought by a stakeholder.

 Risk - A measure of the extent to

which an entity is threatened by a
potential circumstance or event.

 Risk Acceptance - Determining that

the potential benefits of a business
function outweigh the possible risk
impact/likelihood and performing
that business function with no other
action.
 Risk Assessment - The process of
identifying and analyzing risks to
organizational operations (including
mission, functions, image, or
reputation), organizational assets,
individuals and other organizations.
The analysis performed as part of
risk management which
incorporates threat and
vulnerability analyses and considers
mitigations provided by security
controls planned or in place.

 Risk Avoidance - Determining that

the impact and/or likelihood of a
specific risk is too great to be offset
by the potential benefits and not
performing a certain business
function because of that
determination.

 Risk Management - The process of

identifying, evaluating and
controlling threats, including all the
phases of risk context (or frame),
 risk assessment, risk treatment and
risk monitoring.

 Risk Management Framework - A

structured approach used to
oversee and manage risk for an
enterprise. Source: CNSSI 4009

 Risk Mitigation - Putting security

controls in place to reduce the
possible impact and/or likelihood of
a specific risk.

 Risk Tolerance - The level of risk an

entity is willing to assume in order
to achieve a potential desired
result.

 Risk threshold, risk appetite and

acceptable risk - are also terms
used synonymously with risk
tolerance.
 Risk Transference - Paying an
external party to accept the
financial impact of a given risk.

 Risk Treatment - The determination

of the best way to address an
identified risk.

 Role-Based Access Control

(RBAC) - An access control system
that sets up user permissions based
on roles.

 Rule - An instruction developed to

allow or deny access to a system by
comparing the validated identity of
the subject to an access control list.

 Security Controls - The

management, operational and
technical controls (i.e., safeguards
or countermeasures) prescribed for
an information system to protect
the confidentiality, integrity and
availability of the system and its
 information. Source: FIPS PUB 199

 Security Governance - The entirety

of the policies, roles and processes
the organization uses to make
security decisions in an
organization.

 Security Operations Center - A

centralized organizational function
fulfilled by an information security
team that monitors, detects and
analyzes events on the network or
system to prevent and resolve
issues before they result in
business disruptions.

 Segregation of Duties - The practice

of ensuring that an organizational
process cannot be completed by a
single person; forces collusion as a
means to reduce insider threats.
Also commonly known as Separation
of Duties.
 Sensitivity - A measure of the
importance assigned to information
by its owner, for the purpose of
denoting its need for protection.
Source: NIST SP 800-60 Vol 1 Rev 1

 Simple Mail Transport Protocol

(SMTP) - The standard
communication protocol for sending
and receiving emails between
senders and receivers.

 Single-Factor Authentication - Use

of just one of the three available
factors (something you know,
something you have, something you
are) to carry out the authentication
process being requested.

 Social Engineering - Tactics to

infiltrate systems via email, phone,
text, or social media, often
impersonating a person or agency in
authority or offering a gift. A low-
tech method would be simply
 following someone into a secure
building.

 Software - Computer programs and

associated data that may be
dynamically written or modified
during execution. NIST SP 80-37
Rev. 2

 Software as a Service (SaaS) - The

cloud customer uses the cloud
provider’s applications running
within a cloud infrastructure. The
applications are accessible from
various client devices through
either a thin client interface, such
as a web browser or a program
interface. The consumer does not
manage or control the underlying
cloud infrastructure including
network, servers, operating
systems, storage, or even individual
application capabilities, with the
possible exception of limited user-
specific application configuration
 settings. Derived from NIST 800-145

 Spoofing - Faking the sending

address of a transmission to gain
illegal entry into a secure system.
CNSSI 4009-2015

 State - The condition an entity is in

at a point in time.

 Subject - Generally an individual,

process or device causing
information to flow among objects
or change to the system state.
Source: NIST SP800-53 R4

 Symmetric Encryption - An
algorithm that uses the same key in
both the encryption and the
decryption processes.

 System Integrity - The quality that a

system has when it performs its
intended function in an unimpaired
 manner, free from unauthorized
manipulation of the system,
whether intentional or accidental.
Source: NIST SP 800-27 Rev. A


Technical Controls: The security

controls (i.e., safeguards or
countermeasures) for an
information system that are
primarily implemented and
executed by the information system
through mechanisms contained in
the hardware, software or firmware
components of the system.

 Threat - Any circumstance or event

with the potential to adversely
impact organizational operations
(including mission, functions, image
or reputation), organizational
assets, individuals, other
organizations or the nation through
an information system via
unauthorized access, destruction,
disclosure, modification of
 information and/or denial of service.
Source: NIST SP 800-30 Rev 1

 Threat Actor - An individual or a

group that attempts to exploit
vulnerabilities to cause or force a
threat to occur.

 Threat Vector - The means by which

a threat actor carries out their
objectives.

 Token - A physical object a user

possesses and controls that is used
to authenticate the user’s identity.
NISTIR 7711

 Transport Control Protocol/Internet

Protocol (TCP/IP) Model - Internet
working protocol model created by
the IETF, which specifies four layers
of functionality: Link layer (physical
communications), Internet Layer
(network-to-network
communication), Transport Layer
 (basic channels for connections and
connectionless exchange of data
between hosts), and Application
Layer, where other protocols and
user applications programs make
use of network services.

 Turnstile - A one-way spinning door

or barrier that allows only one
person at a time to enter a building
or pass through an area.

 Unix - An operating system used in

software development.

 User Provisioning - The process of

creating, maintaining and
deactivating user identities on a
system.

 Virtual Local Area Network

(VLAN) - A logical group of
workstations, servers, and network
devices that appear to be on the
same LAN despite their
 geographical distribution.

 Virtual Private Network (VPN) - A

virtual private network, built on top
of existing networks, that can
provide a secure communications
mechanism for transmission
between networks.

 Vulnerability - Weakness in an
information system, system security
procedures, internal controls or
implementation that could be
exploited by a threat source.
Source: NIST SP 800-128

 Web Server - A computer that

provides World Wide Web (WWW)
services on the Internet. It includes
the hardware, operating system,
Web server software, and Web site
content (Web pages). If the Web
server is used internally and not by
the public, it may be known as an
“intranet server.” NIST SP 800-44
 Version 2

 Whaling Attack - Phishing attacks

that attempt to trick highly placed
officials or private individuals with
sizable assets into authorizing large
fund wire transfers to previously
unknown entities.

 Wireless Area Network (WLAN) - A

group of computers and devices
that are located in the same
vicinity, forming a network based on
radio transmissions rather than
wired connections. A Wi-Fi network
is a type of WLAN.

 Zenmap - The graphical user

interface (GUI) for the Nmap
Security Scanner, an open-source
application that scans networks to
determine everything that is
connected as well as other
information.
 Zero Day - A previously unknown
system vulnerability with the
potential of exploitation without
risk of detection or prevention
because it does not, in general, fit
recognized patterns, signatures or
methods.

 Zero Trust - Removing the design

belief that the network has any
trusted space. Security is managed
at each possible level, representing
the most granular asset.
Microsegmentation of workloads is
a tool of the model.