Its own lifecycle as users create, use, share, and modify it.

Data Handling Model:

"The knowledge, is usually tacit knowledge at this point"

Data Handling Model:

"Or recording it in some fashion (makes it explicit)"

Data Handling Model:

"The knowledge, may cause the information to be modified, supplemented or partially deleted"

Data Handling Model:

"The data with other users, a copy or by moving the data from one location to another

Data Handling Model:

"The data when it is temporarily not needed"

Data Handling Model:

"The data when it is no longer needed"

Data Handling Practices:

"Dictate rules and restrictions about how that information can be used, stored and shared with others"

Data Handling Practices:

"Security labels are part of implementing controls to protect classified information"

Data Handling Practices:

"Otherwise mandated, organizations are free to create classification systems that best meet their own needs"

Data Handling Practices:

"Compromise of data with this sensitivity label could possibly put the organization's future existence at risk"

Data Handling Practices:

"Compromise of data with this sensitivity label could lead to loss of temporary competitive advantaged loss of revenue or disruption of planned investments or activities"

Data Handling Practices:

"Compromise of data with this sensitivity label could cause minor disruptions, delays or impacts"

Data Handling Practices:

"As this data is already published, no harm can come from further dissemination or disclosure"

Data Handling Practices:

"Information and data should be kept only for as long as it is beneficial, no more and no less"

Data Handling Practices:

"Are applicable both for hard copies and for electric data"

Data Handling Practices:

"Indicate how long an organization is required to maintain information and assets"

Data Handling Practices:

"Data that might be left on media after deleting is known as remanence and may be significant security concern"

*Clearing the device or system

*Purging the device or system

*Physical destruction of the device or system

*In many routine operational environments

The primary form of instrumentation that attempts to capture signals generated by events.

Is essential to identifying inefficient or improperly performing systems, detecting compromises and providing a record of how systems are used

Provide tools to effectively correlate information from diverse systems to fully understand the relationship between one activity and another

An essential function for identifying security incidents, policy violations, fraudulent activities and operational problems near the time of occurrence

Event Logging Best Practices:

"Refers to surveillance and assessment of all inbound communications traffic and access attempts."

Devices and Tools: Firewalls, Gateways, Remote authentication servers, IDS/IPS tools, SIEM solutions, Anti-malware solution.

Event Logging Best Practices:

"Used to regulate data leaving the organization's IT environment.

Data loss prevention/Data leak protection: Email (content and attachments), Copy to portable media, File Transfer Protocol (FTP), Posting to web pages/websites, Applications/Application programming interfaces (APIs)

Protects our personal and business transactions

Used to protect information by keeping its meaning or content secret and making it unintelligible to someone who does not have a way to decrypt (unlock) that protected information

Cryptographic solutions provide a range of services that can help achieve:

A process and discipline used to ensure that the only changes made to a system are those that have been authorized and validated.

Configuration Management:

"Baseline identification of a system and all its components, interfaces and documentation"

Configuration Management:

"A security minimum level of protection that can be used as a reference point"

Configuration Management:

"An update process for requesting changes to a baseline, by means of making changes to one or more components in that baseline."

Configuration Management:

"A regression and validation process, involving testing and analysis, to verify that nothing in the system was broken by a newly applied set of changes"

Configuration Management:

"An audit process can validate that the currently in-use baseline matches the sum total of its initial baseline plus all approved changes applied in sequence."

Is the 1st step in any asset management process.

Example: Catalog or Registry

Is a total inventory of all the system's components, hardware, software, data, administrative controls, documentation and user instructions

Must be acceptance tested to verify that newly installed (or repaired) functionality works as required

The challenge for the security professional is maintaining all patches

Common Security Policies:

"Appropriate use of data"

Common Security Policies:

"Every organization should have a password policy in place that defines expectations of systems and users"

Common Security Policies:

"Defines acceptable use of the organization's network and computer systems and can help protect the organization from legal action"

Common Security Policies:

"An organization may allow workers to acquire equipment of their choosing and use personally owned equipment for business (and personal) use

Common Security Policies:

Understand and acknowledge that type of information and are made aware of the legal repercussions of handling such sensitive data"

Common Security Policies:

"The discipline of transitioning from the discipline of transitioning from the current state to a future state"

Change Management Components:

"All of the major change movement practices address a common set of core activities that state with a common set of core activities that start with a request for change"

Change Management Components:

"To the proper change authorization process based on risk and organizational practices"

Change Management Components:

"Depending upon the nature of the change, a variety of activities may need to be completed"

Learning activities that organizations use:

"The overall goal of education is to help learners improve their understanding of these ideas and their ability to relate them to their own experiences and apply that learning in useful ways"

Learning activities that organizations use:

"Focuses on building proficiency in a specific set of skills or actions"

Learning activities that organizations use:

"Activities that attract and engage the learner's attention by acquainting them with aspects of an issue, concern, problem or need"

Security Awareness Training Examples:

Transforms plaintext into ciphertext

The password to the data

Transforms ciphertext back into plaintext

1) File encryption

2) Disk encryption

3) Device encryption

1) HTTPS (web)

2) Email

3) Mobile applications

4) VPN (network)

Symmetric shapes have identical halves

Keys used for asymmetric encryption and decryption must be from the same pair!

*One-way functions can't be reversed

*The output of a hash function will always be the same length, regardless of the input size

*No two inputs to a hash function should produce the same output

*If they are reversible, or

*If they are not collision-resistant

*Ron Rivest created MD5 in 1991

*MD5 is the fifth in a series of hash functions

*Message digest is another term for hash

*MD5 produces 128-bit hashes

*MD5 is no longer secure

*Produces a 160-bit hash value

*Contains security flaws that render it insecure

*Consists of a family of six hash functions

*Produces output of 224, 256, 384, and 512 bits

*Uses a mathematically similar approach to SHA-1 and MD5

*Secure

*Designed to replace SHA-2

*Uses a completely different hash generation approach than SHA-2

*Produces hashes of user-selected fixed length

*Secure

*Created as an alternative to government-sponsored hash functions

*Produces 128, 160, 256, and 320-bit hashes

*Contains flaws in the 128-bit version

*Insecure

*Hash-Based Message Authentication Code

*Combines symmetric cryptography and hashing

*Provides authentication and integrity

*Create and verify message authentication code by using a secret key in conjunction with a hash function

*Secure

Is essential to preventing reconstruction

Assign information into categories, known as classifications, that determine storage, handling, and access requirements

*Clearing overwrites sensitive information to frustrate casual analysis

*Purging uses more advanced techniques to frustrate laboratory analysis

*Destroying completely obliterates the media through shredding, pulverization, melting, or burning

*Shredding

*Pulping

*Burning

The stages of the lifecycle do not always occur in the same order

*Sensitivity of information

*Criticality of information

Military Classification - Top Secret - Secret - Confidential - Unclassified

Business Classification - Highly Sensitive - Sensitive - Internal - Public

Classification guides other security decisions

When an organization classifies information:

"Identify sensitive information"

Types of information classified by external groups:

"Traceable to a specific person"

Types of information classified by external groups:

"Covered by HIPAA"

Types of information classified by external groups:

"Covered by PCI DSS"

Are a crucial tools for security professionals

Achieve important objectives:

"Who cause the event?"

Also known as Identity Attribution

Example: A specific person, A computer's IP address, A geographic location

Achieve important objectives:

"Uncover all other related events"

Example: Investigating events

Achieve important objectives:

"Provide clear documentation of the events"

1) Central, secure collection point for logs

*All systems send log entries directly to the SIEM

2) Source of Artificial Intelligence (AI)

SIEM:

"Triggers the initial alert"

SIEM:

1) Suspicious connection

SIEM:

2) SQL injection attack

SIEM:

3) Large query

SIEM:

4) Large outbound data flow

Manipulating people into divulging information or performing an action that undermines security

*Authority

*Intimidation

*Consensus

*Scarcity

*Urgency

*Familiarity

Social Engineering:

People defer to authority

Social Engineering:

Scaring people

Social Engineering:

The herd mentality

Example: Riots

Social Engineering:

Getting the last one

Example: Releases a new product

Social Engineering:

Time is running out

Social Engineering:

We say yes to people we like

Education is the solution

Impersonation Attacks:

Unsolicited commercial email

Impersonation Attacks:

Stealing credentials

Impersonation Attacks:

Targeted attack

Impersonation Attacks:

Targeted attacks on executives

Impersonation Attacks:

Using fake websites

Impersonation Attacks:

Voice phishing

Impersonation Attacks:

SMS and IM spam

Impersonation Attacks:

Faking and identity

Security Education Programs:

1) Provides users with the knowledge they need to protect the organization's security

Security Education Programs:

2) Keeps the lessons learns learned during security training top of mind for employees

*Instruction in on-site classes

*Instruction with orientations

*Education through online computer-based training providers

*Participation in vendor-provided classroom training

*Phishing simulations

*Gamification

*Capture the Flag exercises

*Initial training for new employees

*Update training for employees with new roles

*Refresher training on a annual basis

*Awareness efforts throughout the year

Review training materials regularly to ensure relevance