Thanks to visit codestin.com
Credit goes to www.scribd.com

Scribd
Upload
3 views3 pages

Comp Tiach1

The document outlines key concepts in cybersecurity, including the CIA triad (Confidentiality, Integrity, Availability) and the DAD triad (Disclosure, Alteration, Denial) as they relate to cybersecurity threats and risks. It discusses various types of risks from breaches, gap analysis categories, and methods for data protection, including encryption and data loss prevention techniques. Additionally, it covers access control methods and the distinction between segmentation and isolation in network security.

Uploaded by

ansih12
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
3 views3 pages

Comp Tiach1

The document outlines key concepts in cybersecurity, including the CIA triad (Confidentiality, Integrity, Availability) and the DAD triad (Disclosure, Alteration, Denial) as they relate to cybersecurity threats and risks. It discusses various types of risks from breaches, gap analysis categories, and methods for data protection, including encryption and data loss prevention techniques. Additionally, it covers access control methods and the distinction between segmentation and isolation in network security.

Uploaded by

ansih12
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

Ch1: Todays security professionals

Cybersecurity fundamentals (CIA triad )


1. Confidentiality: prevent unauthorized access to sensitive data( firewalls , encryption etc..)
2. Integrity: Ensure data is not altered by unauthorized parties ( Hashing etc..)
3. Availability : Ensure system and data are available when needed ( backups, fault tolerance)

Nonrepudiation
➢ Assurance that someone cant deny an action ( sending message)
➢ Implemented through digital signature

Cybersecurity threats(DAD triad)


➢ Disclosure : Unauthorized access( violates confidentiality )
➢ Alteration: Unauthorized modification (violate integrity )
➢ Denial: Disruption of access ( violate availability )

Types of risks from breaches:


1.finincal Risk: direct or indirect monetary losses.

2.Reputational Risk: loss of trust by customers and stakeholders .

3.Startigic Risks: Long term impact on achieving goals (leaked product plans)

4.Opreational Risks: Disruptes day-to-day functions.

5-Complince Risk: violating laws or regulations ( HIPAA, PCC SD)

**Risks can be in more than one category.

Gap Analysis
By category :
➢ Technical: Software/Hardware tools (firewall, encryption)
➢ Operational: Day-to-day practices (log reviews)
➢ Managerial: High-level planning and risk analysis
➢ Physical: locks, camera, fencing.

Information Classification: Public


By Type:
➢ Preventive: sops incident (access controls)
➢ Detective: identifies incident (IDS)
➢ Corrective: Fixes issue post-incidents (backups restore)
➢ Deterrent: discourages attacks (warning signs)
➢ Compensating: Alternatives when primary control isn’t feasible.
➢ Directive: guides behavior ( polices )

Data Protection:
Three data states:
1.Data in Rest: stored data , protect with encryption.

2.Data in transit: Network-transmitted ; protect with encryption.

3.Data in Use: Actively processed data, protect memory

Encryption:
Convert data into unreadable form unless decrypted.

Protect both stored and in transmitted data.

Data Loss prevention (DLP)


Prevent unauthorized sharing or leakage of sensitive data:

Types of DLP:
➢ Agent-Based: installed on devices.
➢ Network-Based: monitors traffic on network.

Methods of DLP:
➢ Pattern matching: Detects data formats like SSns.
➢ Watermarking: Track tagged documents.

Data Minimization and Obfuscation


Techniques:
➢ Hashing: one way transformation ( vulnerable to rainbow tables)
➢ Tokenization: Replaces data with a unique ID ( reversible with lookup)
➢ Masking: Partially hides data( credit card numbers)

Information Classification: Public


Access control
➢ Geographic: based on location.
➢ Permission-based: Based on user roles and authorization.

Segmentation Vs. Isolation


➢ Segmentation: Network separation with some communication allowed.
➢ Isolation: No external communication at all.

Information Classification: Public

You might also like