Security 1.1

Network Security
1 - Defense in Depth

• Core framework for information security

• Three essential pillars:

  • Confidentiality

  • Integrity

  • Availability

• Guides organizational security policies and practices

​CIA TRIAD

Multiple Choice

What does CIA stand for in cybersecurity?

• Confidentiality, Integrity, Availability
• Confidentiality, Identity, Accountability
• Control, Integrity, Access
• Confidentiality, Integrity, Authentication

Multiple Choice

The CIA Triangle is primarily used for:

• Financial analysis
• Military strategy
• Information security

• Public relations

• Restricts access to authorized users only

• Protected through:

  • Authentication systems (MFA)

  • Encryption methods

  • Access permissions (Least Privledge)

• MFA: What you have, what you know, what you are

• Businesses use labeling like privileged, top-secret, internal use only

​

​Confidentiality

Multiple Choice

Which is NOT a method of maintaining confidentiality?

• Using secure communication channels
• Implementing data encryption
• Public posting online

• Restricting access to sensitive information

Multiple Choice

Confidentiality protects against:

• Unauthorized access

• Data corruption

• System crashes

• Power outages

-Ensures that data remains accurate and unaltered during storage or transfer.
-Can be maintained through auditing and encryption.
-Digital signatures and headers are used to ensure integrity

​

​Integrity

Multiple Choice

What is an example of failed integrity in the CIA triad?

• Unauthorized modification of data in a financial report.
• Access controls to limit user permissions.
• Regular backups of data to prevent loss.
• Data encryption to protect sensitive information.

-Data is available when needed
-Possible threats
-Cyber Attacks
-Natural Disasters
-Hardware Failure
-Techniques: Redundancy, fault tolerance, backups

​Availability

Multiple Choice

What is not a threat to data availability?

• Natural disasters affecting server locations
• Data corruption due to malware
• Regular maintenance and updates of systems
• Power outages disrupting service

Multiple Choice

Which of the following enhances availability?

• Regular backups only
• Single point of failure
• Manual intervention for recovery
• Fault tolerance

Repudiation: Rejection of an event of idea

Non-repudiation: to prove that someone did something even if they say they didn't

-Authenticaton
-Logging
-Security cameras

​Non-repudiation

Multiple Choice

What is non-repudiation?

• A security measure that prevents an entity from denying the authenticity of their actions.

• A process that allows users to change their previous actions.
• A technique for encrypting data during transmission.
• A method to verify the identity of a user.

• Any potential danger to information or systems

• Examples: Malware, phishing, insider threats

​Threats

• Any potential danger to information or systems

• Examples: Malware, phishing, insider threats, 0 day attacks

​

​Vulnerability

• Likelihood that a threat will exploit a vulnerability

• Risk = Threat × Vulnerability × Impact

• Register can include category, probability, impact, threshold, cost,

  and contingency plan

• Risk includes cost, scope and time

• Contingency plans in case of reality

​

​Risk

Multiple Choice

A threat can be defined as:

• A guaranteed outcome of a successful incident.
• A strategy to eliminate all possible dangers.
• A measure of security against potential risks.
• A potential cause of an security incident.

Multiple Choice

A vulnerability is:

• An upgrade to improve software functionality.
• A method to secure data from unauthorized access.
• A feature that enhances system performance.
• A weakness in a system that can be exploited.

Multiple Choice

What formula represents risk?

• Risk = Exposure - Control x Vulnerability

• Risk = Threat x Vulnerability
• Risk = Cost + Time x Impact

• Risk = Threat x Vulnerability x Impact

• Limiting user access to only what is necessary

• Reduces risk and attack surface

​

​Principle of Least Privilege

• The sum of all points where an attacker can try to enter a system

• Includes IoT devices, software interfaces

​

​Attack Surface

• IoT devices often lack robust security measures

• Key risks: Lack of updates, default credentials

​

​IoT

Multiple Choice

What is PoLP?

• Principle of Maximum Privilege
• Principle of Least Privilege

• Policy of Least Access
• Protocol of Least Permission

Multiple Choice

Which of the following can increase attack surfaces?

• Monitoring network traffic

• Adding IoT devices

• Using encryption

• Limiting user privileges

“Why are we able to trust ATM machines?”

Write a paragraph to explain why we can trust ATM machines that support the following points:

• Confidentiality.

• Integrity.

• Availability.

​

​CIA in your life...