DOMAIN 1 SECURITY AND RISK MANAGEMENT DOMAIN
Personnel Security Policies and Procedures
1) screening and hiring 2) Employment agreements and policies (nda's, drug tests, references, interviews of associates, social media) 3) Onborading and termination 4) vendor consultant and contractor agreements (supply change risk) 5) Compliance policy requirements (statutory and regulatory obligations to validate things are done in a certain way) 6) Privacy policy requirements (mgmt and expectation of mgmt of PII (HIPAA)) about due diligence and oversight procedure is about due care
Control Types
1) technical or administrative measures in place to assist with resource management i.e., Directive, Deterrent, Preventive, Detective, Corrective, Recovery
Control Categories
1. Administrative Controls 2. Logical Controls 3. Physical Controls
Threat Modeling Process 5 Steps *****MUST KNOW*****
1. Identify Security Objectives 2. Survey the Application / system (we may be doing modeling on an application or an entire system) 3. Decompose it (take it apart and put it back together to see all possible attack vectors) 4. Identify Threats 5. Identify Vulnerabilities; 4 and 5 are different what are we looking for in each step
Conduct assessment - Step 2 Qualitative
1) Get Org chart - decision makers, levels responsibilities 2) Inquire what the assets are (intellectual, real property assets, computer/office equipment, people their rate of pay and value) 3) After identify threats and vulnerabilities to those assets what is the risk 4) conduct assessment determine the likelihood (high, med or low rating) and impact (high, med or low rating) (walk-through, questionnaire - if answer no to question then may have a vulnerability if there is a threat 6) Overall risk rating 7) Handle the risk - SEE 4 risk responses
Key Concepts of GDPR
1) Harmonization across and beyond the EU 2) Personal Data 3) no distinction between personal data about individuals in their private, public or work roles - the person is the person
Public Sector Control Classes (Gov't)
1) Management 2) Operational 3) Technical/Logical
Addresses the "WHY" of policy
1) Methods and techniques to present awareness and training - briefings, online or real time, live, pre-recorded, document 2) Periodic content reviews 3) Program effectiveness evaluation - audio, visual, reading,
Planning Horizon - 3 Types of Goals
1) Operational 2)Tatical 3)Strategic
Conduct Assessment -Step 2 Quantitative
1) Org chart 2) ID assets and value 3) ID threats estimate potential loss SLE=AV * EF 4) Perform threat assessment 5) Handle the Risk? (Reduce it, mitigate, ignore, Get/see the firewall, ids sys, how many attacks did your IDS/firewall have over the year and how many of those turned out to be real attacks, statistics, logs, etc. what was monetary loss you had; almost impossible to do purely quantitative risk assessment;
NIST Overall Risk Assessment Process Steps 1 of 4
1) Prepare for assessment 2) Conduct assessment 3) Communicate Risks/Results 4) Maintain assessment
Skills or Things you need in BCDR/BIA
1) Project mgmt, 2) senior mgmt support* (extremely impt; if no support, no due care or diligence = no mitigation of risk; decision makers are backing because culture flows from them and support comes from them), 3) project scope (what is our our focus, limited resources; mindful; scope document helps to filter down to what is really needed; POC, sow), resources (clearly identify resources whether physical or people WBS, document info), timeline
4 canons of the Code of Ethics
1) Protect society, the common good, necessary public trust and confidence, and the infrastructure; Life/people safety is more impt than info 2) always Act with honor, hones, responsibly, and legally; be aligned with legal requirements 3) Provide diligent and competent service to principals; Make sure we do our job, show up every day, trained and up to the task 4) 1. never put CIA at odds with the mission and objectives of the organ; Advance and protect profession; never put ourselves, our co, profession or customers in a bad light i.e., ethical hacking
Two ways to measure risk
1) Qualitative risk assessment subjective deep knowledgeable people 2) Quantitative risk assessment based on reas can hybrid expressed use people with different kinds of skills; but can be hybrid assessment that mixed together
Penetration Testing Methodologies - 5 Steps (whether hacking or white hat)
1) Reconnaissance - fact finding; prepare the assessment 2) Enumeration 3) Vulnerability analysis - analyze vulnerabilities, weakness identification; 4) Execution / Exploitation - to gain access; still need to validate how far can go (i.e., can get in, but no username and password; worth noting but not the same as no username at all) 5) Document findings - look for ways to create opportunity to remediate and give value; what are other areas we can look to pen test on; overview; executive report highlighting the most detailed report; appendix
There are 8 domains
1) Sec and Risk Magmt 2) Asset Sec 3) Sec Architecture and Engineering 4) Comm and Network Sec 5) Sec Identity and Access Mgmt 6) Sec Assessment 7) Sec Operations 8) Software Dev Sec
5 aspects of the Standards of Good Practice for Information Security
1) Security mgmt 2) Critical business applications 3) Computer Installations (our hardware and how we build it) 4) Networks - How we comm and collaborate between two or more sys's connected over LAN or WAN via IP's, VPN's, DNS, dhcp, etc. and 5) SDLC - sys or software and how we choose to identify, document and build it
5 ITIL Life cycle phases
1) Service Strategy 2) Service Design 3) Service Transition 4) Service Operation 5) Continual Service Improvement CSI
Types of Attacks
1) Social Engineering 2) Pretexting 3) Phishing 4) Baiting 5) tailgating
4 things help us in a BCP Program
1) Talk to senior mgmt to get buy-in approval MUST BE in writing 2) define the scope or coverage (what will be inside and outside of the scope) 3) Estimate project resources - cost$ what do we have available, what can we do; the knowledge - the capability to do these things is a resource (i.e., we may have a constraint on knowledge) 4) We have to define a timeline that all of these things will take place
8 individual rights under GDPR
1) right to be informed 2) right of access, 3) Right to rectification, 4) Right to erasure, 5) Right to restrict processing, 6) Right to data portability, 7) Right to Object 8) Rights in relation to automated decision making and profiling
Predisposing event
An event that makes someone liable or inclined to specified attitude, action, or condition, are we patching, testing, vulnerability assessment, baseline assessment
5 categories of NIST CSF
Identify, Protect, Detect, Respond, Recover
Conduct Assessment -Step 2 Qualitative
Can be done Qualitatively or Quantitatively; Qualitatively - interviews w/key players subject matter experts to tell what the assets are; the types of threats and vulnerabilities faced; what is likelihood vulnerability can be exposed and what impact would be if exposed
ISO27006
Certification agency, A guide to the certification/registration process
CSRC
Computer Security Resource Center
SP8161R2
Computer Security incident handling
NIST SP800-160 Vol1 | Vol2 Systems Security Engineering
Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems
Downtime
Consists of two elements, the systems recovery time and the work recovery time. Therefore, MTD = RTO (Recovery Time Objective) + RPO. The time available to recover disrupted systems and resources
Maintain assessment - Step 4
Continuously monitor; Every six months review the assessment and update it (iterative process); develop Risk Register upto date, see if vulnerabilities have changed; new threats
Trade Secret Law
Corporate resource that protects a specific resource and provides the organization with a value or advantage
Business Risk
Cost of doing business; The possibility of loss (failure) or gain (success) inherent in conducting business
Due care
Identifying what you need to do and Ensuring you are complying with laws, Rules, Reg's., etc. It is about knowing what to do; asking are you doing things that a reasonable person would do; standard of care used. Is the care you are using documented, and approved to minimize risk;
A good investment is
If it costs as much or less than the cost to purchase then it is seen as a good investment; If it cost more than, it still may be seen as a good investment, but we have to increase the recoup time to see the return. Instead of 12 months, maybe 24 months
FIPS 199
Impact Assessment where you are just looking at the impact of different types of data; NOT a Risk Assessment because only looking at Impact and not Likelihood
Continuity of Operation Plan (COOP)
Implies there is a disaster and you have to recover to an alternate site
Public sector is more concerned with
Confidentiality
CVSS
Created by US Common Vulnerability Scoring System; Open protocol for scoring new vulnerabilities; brings together major players in the technology and I.T. and security spaces.People in companies and entities like Cisco, Symantec, Microsoft, etc,to really contribute behind the scenes, research, vulnerability, information, etc.To come up with a common system that could then expose, discuss and score vulnerabilities and make them available, so we can then interact with them
MTD Times
Critical = min's to hours Urgent = 24 hours Important = 72 hours Normal = 7 days
ISO27010
Critical infrastructure management
Personal data
Data about a living identifiable person, which is specific or uniquely identifiable to that person (physical, physiological, genetic, mental, economic, cultural or social identity - 23 and me)
Security awareness training ****IMPT TO KNOW****
Establishing an understanding of the importance of, and need to, comply with security policies within the organization; should break up (mgmt, mid-level, technical) can lead to risk mitigation which leads to the reinforcement of through good clear communication and good documentation, standardization of behavior and as a result of that risk mitigation.
EAL
Evaluation Assurance Level
Framework for specification of evaluation Protection Profile (PP)
Evaluation Assurance Level (EAL 1-7)
COBIT IT Governance framework associated with GRC (governance risk and compliancy)
Examines the effectiveness, efficiency, confidentiality, integrity, availability, compliance, and reliability of high level control objectives. Having controls, GRC heavy auditing, metrics, regulated industry
Supply Chain Risks
Examples: Insertion of counterfeits, unauthorized production, tampering, threat, insertion of malicious software and hardware (GPS tracking, computer chips), poor manufacturing and development practices in the supply chain. These risks are realized when threats in the supply chain exploit existing vulnerabilities
Data controller Accountability
Exercises due diligence. The processor under the guidance provided by the controller through due diligence exercises due care. The data controller is the overseer and has accountability. They ensure that all these other seven things are happening and shaping the discussion, the interaction, the collection, the management, storage usage, etc., throughout the data life cycle of the data. If we don't have oversight function or if we don't bring due diligence, we don't act through the other seven areas with due care, we're not exercising the proper level of thought, protection, integrity and confidentiality around our data
prevent, detect, correct
First reaction is PREVENT a security breach since can't prevent unknown Second is to DETECT and then take a CORRECTIVE action
Timelimits for GDPR
Guidance only - data controllers must notify the appropriate supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it." If notification is not made within 72 hours, the controller must provide a "reasoned justification" for the delay; 30 days for request for personal information
NIST SP800-30R1 *****IMPT TO KNOW*****
Guide for conducting risk assessments
NIST SP800-30R1 p12 (IMPT)
Guide for conducting risk; SP800 series goes all the way back to the 1970's or so And is the foundation for much of the modern reference we have for guidelines. SEE IMAGE
NIST SP800-121R2
Guide to Bluetooth Security
NIST SP837R1
Guideline for applying risk mgmt framework (RMF or risk mgmt framework to Federal Syst's); originally 837
NIST SP800-88R1
Guidelines for Media Sanitization
Integrity Controls applied
Hashing, separation of duties, dual control (two man rule launching a weapon, safety deposit box)
HIPAA
Health Information Portability and Accountability Act; Act means it's a law and regulation medical industry. HITECH applicable to BAA's. If they don't say specifically that it's a law, then applies to industry
ARO (Annualized Rate of Occurrence)
How often over a single year are we going to see that occur (i.e., 3 times)
Risk Assessment Process
How we figure out what a risk is; it is a process
Qualitative Risk Assessment
INTANGIBLE; determines the product of likelihood of risk to produce a level of risk; the higher the risk the more immediate the need; an environmental hazard based on human perception rather than data; NOT numerically or metrically based but uses a soft factors like brand, reputation, the impact to that co may be negatively perceived (Risk Matrix)
ISO27009
IS governance
ISO27003
ISMS implementation guide
ISO27004
ISMS metrics
COBIT 5
IT business framework for the governance and compliance or risk mgmt created by ISACA.org and focused on GRC activities; COBIT allows us to frame the concepts and the conversations within the business around IT governance and what governance, risk and compliance mean
The GDPR provides exceptions to this additional requirement for the controller to notify data subjects in the following circumstances
1. The controller has "implemented appropriate technical and organisational protection measures" that "render the data unintelligible to any person who is not authorized to access it, such as encryption" 2. The controller takes actions subsequent to the personal data breach to "ensure that the high risk for the rights and freedoms of data subjects" is unlikely to materialize. 3. When notification to each data subject would "involve disproportionate effort," in which case alternative communication measures may be used
Additional Concepts for Integrity
1. accuracy 2. authenticity 3. validity 4. nonrepudiation - user cannot deny having performed an action; when we have integrity with our email and have a digital signature and hashing creating a message digest, we use nonrepudiation,
Three ways in which we can understand Integrity:
1. preventing unauthorized subjects from making modifications (users seeking to access data NPE non-person entities (user or application or account proxying on our behalf, a computer account) 2. preventing authorized subjects from making unauthorized modifications 3. maintaining consistency of objects so that they are true and accurate (ensure the data or asset is consistent kept in a true good known state; data can be modified by a system process of flags are changed on that data; timestamp, meta data)
Confidentiality Concepts
1. sensitivity 2. discretion (may have more than one scenario, but choose the best correct answer; minimizes administrative overhead and cost) 3. criticality 4. concealment 5. isolation 6. integrity 7. principle of least privilege 8. need to know
Availability Concepts
1. usability 2. accessibility 3. timeliness
Security Safeguards
3 layers: technical safeguards, data safeguards, and human safeguards; vlanning, access control
BIA Process 4 Steps (KNOW IN ORDER) (SP800R1)****MUST KNOW***
4 steps Step 1 - Gather info (interviews re svcs); Step 2 - vulnerability assesment - weaknesses of sys's (outage, attack, ? take them out of svc); Step 3 - risk analysis the outcome qual (opinion 1 to 10) and quant ($ based ALE = SLE * ARO) - threat analysis to determine what would happen if svc not avail); Step 4 - Comm Findings
Individual Participation
A fair information practices principle, ask the individual to opt-in; can't assume we can take your data without your knowledge and consent
Information Security Handbook
A guide for managers SP800-100
Risk Matrix
A matrix that lists an organization's vulnerabilities, with ratings that assess each one in terms of likelihood and impact on business operations, reputation, and other areas; typically high impact, high urgency would be at the uppermost right-hand quadrant.Typically, where it's lower we'd see low impact, typically lower left.
Safe Harbor (PRIVACY)
A negotiated agreement between two parties that relaxes the regulatory requirements and burden by allowing the participant that is negotiating to adhere to the spirit of the law as opposed to the letter of the regulatory compliance. I.E., things like the directive 95/46 and writes around personally identifiable information and privacy rights, but it could deal with a variety of things
COE is made up of
A) COE Preamble B) COE Canons - 1) Protect society, commonwealth and infrastructure (DO NO HARM AND PROTECT LIFE ABOVE ALL ELSE) 2) Act honorably, justly, responsibly, and legally 3) Provide diligent and competent service to principals 4) Advance and protect the profession \ 3) Organizational COE
Formula for quantitative risk assessment
ALE =SLE * ARO ALE = annual loss expectancy SLE = single loss expectancy ARO = annualized rate of occurrence
The Computer Security Act 1987
Aimed to Improve the security and privacy of sensitive info in federal computer systems and to establish a minimum acceptable security practice for these systems
Supplementation
All about making additions or adding on (resources, things that overlap) in order to reinforce to give us more value to support of mission objectives of the assessment; if we haven't scoped or tailored, we cannot measure properly to know whether we are doing well or not
Data Protection Officer (DPO) (GDPR)
All public authorities have it; expert knowledge of law and data; the that independent voice that sits above controller and data processor; they monitor compliance; advise with regards to impact assessments under Article 33; work with the controller or processor as the supervisory authority and the key contact point for that authority; single voice of communication; single conduit for information flow between the organization and any outside exchange around issues supporting and/or in alignment with GDPR; all communication in and out
Memorandum of Understanding (MOU)
An agreement between two or more parties to enable them to work together that is not legally enforceable but is more formal than an unwritten agreement. (M&A)
Penetration Strategies
Microsoft Baseline Security Analyzer (MBSA) ⦁ Ext Testing (white box) - pay someone to test system ⦁ Int Testing - do test internally, red/blue teams, tiger teams are terms used in govt, military and private sector ⦁ Blind Testing (black box) - involves either one of the two groups involved in testing knows something the other doesn't know (similar to external or internal testing) ⦁ Double-blind Testing (both internal and external teams are not told anything; they will get ip's that are off limits or life-safety things which goes back to scoping and tailoring)
Tactical management
Mid-Term Goals - (The thing we do Monthly or weekly) goals that involve how the security systems are developed and implemented to meet policy requirement
Security Control Assessments (SCA)
Monitor the controls we use to assess how well they are performing; different controls or countermeasures applied and assess on an ongoing basis of how well the are doing. when things change, we may need to change
countermeasure control categories
Must be cost, effective and appropriate. They should also provide value - cost effects how we deal with quantitative assessment risk and evaluation of risk. We ask how much will we have to spend to acquire and/or implement against the actual problem; we are attempting to mitigate risk; if the counter measure costs as much as the problem we still may want to have it depending on how long the risk is around
Risk Assessment Methodologies***IMPT TO KNOW ***
NIST 800-66r1 FRAP NIST 800-38 OCTAVE NIST 800-30r1 SOMAP CRAMM VAR FM & EA Spanning Tree
Places to find updates
NIST, ISF, ISO, BSIMM
NIST
National Institute of Standards and Technology. NIST is a part of the U.S. Department of Commerce, and it includes an Information Technology Laboratory (ITL); Globally recognized; US gov't institution f/k/a the National Bureau of Standards; NIST is the United States National Measurement Institute and promotes and maintains measurement standards for government agencies, academia and industries. It also has active programs for encouraging and assisting industry and science to develop and use these standards.
Octave 2003 *******MUST KNOW**********
Operationally Critical Threat, Asset, and Vulnerability Evaluation) 2003; risk management threat modeling framework
OEDC (PRIVACY)
Organization of Economically Developed Countries - in 1985 originated trans-border data flow; privacy principles that help to focus on how we capture info, manage it, and what we do with it; the OEDC developed the 8 core principles of privacy
AS/NZS 4360
Original 2004 and updated in 2009; tied to an ISO implementation; world's first Australian and New Zealand risk mgmt standard made up of 5 steps. a risk mgmt methodology can be used to understand a company's financial, capital, human safety, and business decisions risks. Although it can be used to analyze security risks, it was not created specifically for this purpose. This risk methodology is more focused on the health of a company from a business point of view, not security.
Private Sector Control Classes
Overarching above Control Types 1) Physical (guards guns and gates), 2) Administrative (policy based, rules) 3) Logical (technical) (things we implement through software vpn or vlan
Contingency
PREDICT A possible future event that must be prepared for or guarded against; possibility
Safeguard
PROACTIVE Security Control put in place BEFORE vulnerabilities are exposed; to prevent exposure
Use Limitation
Personal data should not be disclosed or used for purposes other than stated in the Purpose Principle, except with the consent of the individual or by the authority of law (ex. if your doctor collects data to treat you, they cannot then sell that data to another without your knowledge and consent)
NIST SP800-193
Platform Firmware Resiliency Guidelines
PIA (GDPR)
Privacy Impact Assessment
NIST SP800-171R1
Protecting Controlled Unclassified Information in NON-FEDERAL Systems and Organizations
countermeasure (control measure) ********MUST KNOW************
REACTIVE Security Control we use to deal with, AFTER, the likelihood of a threat's adverse impact
Guidance
Recommendations, suggestions or a set of steps, procedures, processes, a path and How we measure whether we are successful or not at doing something
BIA or business impact Analysis (coop operation)
Risk mgmt mitigation tool used to understand and determine what impact a disruptive event would have on an organization; how business critical services if disrupted would rank by priority; it's about measuring the importance of services because we have a limited amount of resources and time so everything doesn't warrant the same protection; The BIA helps us frame risks and rank services by their impt and why; should be done, examined, renewed and refreshed semi-annually or at least once a year
SP means
SP for special publication and R stands for Revision
The concept of Safe Harbor is
Safe harbor (2000) is the idea that we can negotiate an agreement in this case between two countries or more countries, the EU and US, an agreement almost like a side line agreement that allows us to stipulate that we will not violate the letter of an agreement will comply with the spirit of the law
NIST SP800-125AR1
Security Recommendations for Server-based Hypervisor Platforms
Availability
Security actions put into place for continuity and in the event of a disaster; they ensure that AUTHORIZED users can access data at the appropriate times
NIST SP800-R5
Security and Privacy Controls for Information Systems and Organizations
NIST SP853R4
Security controls for federal gov't information systems. the most current one is currently 853R4
Operational risks
Short term goals (Things we do daily vulnerability scanning, reviewing of logs) - concerned with performing day to day business transactions of the organization; threats inherent in the technologies used to reach business success
Information Security Forum
Standards of Good Practice for Information Security; where we get 5 aspects (standards of IS); broken into 30 areas and 135 sections
Goals, Missions and Objectives are made up of
Strategic view - Goals Tactical View - a. what you do and how you execute Operational vision - stitches the goals and tactical views together Strategy - managed through policy and procedures
NIST SP800-161 p7 ******IMPT TO KNOW*******
Supply chain and risk mgmt practices for Federal Information systems; even though says for federal use, it is used worldwide to manage supply chain and third party risk in an orga
Quantitative
Tangible; When we quantify the measure of risk; a numerical assessment assigned when we drill down our understanding and assessment of the potential impacts of risk.
Vulnerability Assessments/testing
Tell us what weaknesses exist in our network; we test to make sure what we think is happening is actually happening; trust but verify; can be a physical or software configuration or misconfiguration
Rights in relation to automated decision making and profiling
The GDPR provides safeguards for individuals against the risk that a potentially damaging decision is taken without human intervention (big data, ai, machine learning); can't let a computer alone make a damaging decision that can impact you negatively. A human must be involved in that process.We could still have the computers spit out all that stuff and recommend yes or no, But a human must go through, look at that, and then ultimately make that decision
ITIL
The Information Technology Infrastructure Library (ITIL) is a service framework for how we provide Information Technology Services Management (ITSM) to the business. ITIL gives detailed descriptions of a number of important IT practices and provides comprehensive checklists, tasks and procedures that any IT organization can tailor to its needs.
Integrity Controls give you
The ability to oversee, monitor and manage the current, present, well documented, agreed upon state of data so that if it were to be modified in any way, we would have record or knowledge of it and have the ability to go back through incident response; changing or removing data is a violation of the integrity w/o prior consent
Privacy by Design
The concept that organizations need to build privacy directly into technology, systems and practices at the design phase, thereby ensuring the existence of privacy from the outset. Originating in the mid-1990s by the Information and Privacy Commissioner of Ontario, the principle has gained recognition around the globe, including from the U.S. Federal Trade Commission and the European Commission.
RTO (recovery time objective)
The max amt of time it will take to recover from an event; RTO AND MTD can be the same but no margin for error if things don't go well will have no buffer; Better if RTO is less than MTD
Maximum tolerable outage (MTO)
The maximum time that the organization can support processing in the alternate site - O = outage alt facility
Exposure Factor (EF)
The measure or percentage of loss experienced IF a specific asset were attacked
E-Privacy Regulation is lateral to the GDPR
This global legislation controls/regulates the flow of personal data and the management of data across all electronic communications including telephony (i.e., non verbal communication over the web using a form RDP); significant penalties for non-compliance. In the UK this regulation will replace the exiting PECR laws;
USCU Safe Harbor framework
US maintained website
Right of access
Under the GDPR, individuals will have the right to obtain: • confirmation that their data is being processed; • access to their personal data; and • other supplementary information - this largely corresponds to the information that should be provided in a privacy notice (see Article 15)
Export Administration Regulations (EAR)
Under what conditions can we export (US) - dual use goods
Examples of assessments
Vulnerability, penetration testing,
Impact ********MUST KNOW************
What a threat will cost qualitative and quantitative
loss potential
What the company would lose if a threat agent actually exploited a vulnerability
Examples of due care
When practitioners implement through procedures - need to know, least privilege, job rotation, separation of duties
Right to restrict processing
When processing is restricted, you are permitted to store the personal data, but not further process it. You can retain just enough information about the individual to ensure that the restriction is respected in future (backups)
Management framework
Zachman framework, the Calder-Moir framework, TOGAF, DODAF, MODAF
Categories of Penetration Testing
Zero knowledge a/k/a black box - NO knowledge Partial knowledge a/k/a grey box - SOME knowledge Full knowledge a/k/a white box - on inside and know all
data breach or personal data breach (GDPR)
a breach of security leading to accidental or intentional, unlawful, willful destruction of data, loss, alteration, unauthorized disclosure of and/or access to personal data transmitted, stored or otherwise processed
Preventive
a camera and a sign or a lock
security frameworks allow us to have
a common vocabulary, create context, and have a central and shared point of reference and commonality for our communication, discussion, and dialogue around how we approach managing and they structure and define a set of requirements and elements that help us to measure whether or not we're being effective in what we do
Risk Assessment
a component of risk management; 4 steps to completing risk assessment
Deterrent
a control - deters you from doing something (i.e., cameras)
Consent must be freely given
a controller cannot insist on data that's not required for the performance of a contract as a pre-requisite for that contract
code of ethics a/k/a code of professional ethics
a formal statement of ethical principles and rules of conduct; COE's help to standardize behavior, conduct and focus in and around the organization
The Economic Espionage Act of 1996
a law that makes the theft of trade secrets by foreign entities a federal crime in the United States; (Edward Snowden)
MTD (Maximum Tolerable Downtime)
a measure of time; The longest period of time a business can be inoperable without causing the business to fail irrecoverably. It encompasses the entire window of time from the beginning of RTO to resume production
Directive
a policy control - only allow this for this reason; we only allow remote access through VPN
Threat Modeling (risk mgmt)
a process for defenders use to systematically identify, enumerate and prioritize potential threats - viewed from a hypothetical attacker's point of view.; allows for use-cases; to use attack vectors, attacking tools or approaches, used to view the world from a bad actor's point of view and ask questions about "what if" this happened, what are our concerns and the targets or assets they want; what would we do; may involve tying into vulnerability and pen testing to have a complete package to assess and examine
Trademark
a recognizable sign, design, or unique expression related to products or services of a particular source from those of others, usually called service marks
COSO (Committee of Sponsoring Organizations)
a risk framework; it speaks about the control element of risks, how we setup controls, manage it and control it - 5 areas of internal control
Reputational Risk
a risk of loss resulting from damages to a firm's reputation, in lost revenue; increased operating, capital or regulatory costs; or destruction of shareholder value, consequent to an adverse or potentially criminal event even if the company is not found guilty.
Delayed Loss
a secondary in nature and takes place well after a vulnerability is exploited. and may include damage to the company's reputation, loss of market share, accrued late penalties, civil suits, the delayed collection of funds from customers
Patent
a set of exclusive rights of OWNERSHIP granted by a sovereign state or governmental organization to an inventor or a signee for SOMETHING NEW/NOVEL, USEFUL AND NOT OBVIOUS a limited period of time (typically 20 years) in exchange for detailed public disclosure of an invention
intellectual property (IP law)
a set of laws and thought processes we apply to data; intangible creative work that is embodied in physical form and includes copyrights, trademarks, and patents; sensitive, pii, financial data, information about m&a to manipulate stock prices; They must be able to demonstrate that they took steps to secure it
Integrity controls or countermeasures
a. strict access controls / authentication b. IDS (passive monitoring sys that alerts when something goes wrong but doesn't take action) c. encryption (doesn't matter if you get it, just so long as the encryption holds best safeguard) d. hashing (is not about keeping data secure or secret by encryption it's about no changes to the data occur and if it does occur, you have permission to do so) e. interface restrictions / controls (can only access this workstation under strict controls) f. input / function checks (validation when typing in data and asking you to safe it you insert your smartcard to make sure you have permission to save it)
Availability controls or countermeasures
a. strict access controls / authentication b. continuous monitoring c. firewalls & routers to prevent DoS / DDoS attacks d. redundant system design eliminate SPOF (single point of failures) e. periodic testing of backup systems; Redundancy, backups, remote site hosting (hot, warm cold sites), high availability (cluster active/passive) and fault tolerance (0 downtime)
Right to erasure
a/k/a 'the right to be forgotten; this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing
Data Processors in GDPR
act with due care; they are the entity that actually performs the data processing ON THE controller's behalf
contractual
agreed in a contract (verbal) standardized and adheres to requirements
Should the controller determine that the personal data breach "is likely to result in a high risk to the rights and freedoms of individuals," it must
also communicate information regarding the personal data breach to the affected data subjects. Under Article 32, this must be done "without undue delay.
GDPR also allows the data protection officer functions to be performed by
an employee of the controller or processor or by a third party service provider
The ITIL framework is
an enterprise mgmt framework that comes from British or other governmental military mgmt; it defines what customer service is in IT and how we measure it; it standardizes the selection, planning, delivery and support of IT services to a business
Breach
an occurrence or event that has compromised data and impacted one or more of the CIA and as a result has modified, disclosed or rendered the data unavailable, with a negative outcome; a countermeasure being bypassed or rendered ineffective
Threat Source a/k/a threat actor or BAD actors ********MUST KNOW************
any kind of event or situation that has negative consequences or if it occurred would prevent normal operation of the organization; can be internal or external (i.e., not just hackers, but red and blue teams because they are negotiated and approved by the customer)
User
any person who has access to a secured system
Threat event
any potential adverse occurrence or unwanted event that could injure the organization or prevent the normal operation; all events are not bad
Regulations
apply to governmental agencies and industries the use of governmental authority to control or change some practice in the private sector; punishment loss of license or designation
Risk Management
applying overlapping controls and counter measures to mitigate risk and minimize them to the point of toleration, based on our risk appetite in the business; change management and risk management - you have to have both
CMMI and UML
are not threat models, right.They may provide elements in frameworks associated with aspects you may engage in with threat modeling, but they're not threat models
ISO 27002
are the security controls that help us frame ISO 27001; Organisations can achieve certification to ISO 27001 but not ISO 27002
E-Privacy Regulation is important for digital marketing activity
as it overrides the GDPR's allowance for legitimate interests and enforces consent on all digital communications for marketing purposes. There will still be an allowance for the "soft opt-in" where customers can be communicated to about similar goods and services with an opt-out only, but it should be noted that the wording here has been tightened restricting the use to customers only
willful destruction or alteration of data is
as much a breach as theft; it's about integrity, confidentiality and availability
ISO27007
audit
Copyright covers
books, advertisements, articles, graphic designs, labels, letters (including emails), lyrics, maps, musical compositions, product designs, etc.
BS 7799 Part 1, ISO 17799, ISO 27002
code of practice; ISO came from the British security standards BS7799 and ISO 17799; 133 controls, 500 plus detailed controls built on called BS 7799 which is the original British security standards document
Computer related crimes
computer-incidental crimes
"downstream" responsibility of DSAR's
controllers to take "reasonable steps" to notify processors and other downstream data recipients of such requests
Access Controls
controls that restrict unauthorized individuals from using information resources and are concerned with user identification; temporal, time based; discretionary, managed
STRIDE Methodology *******MUST KNOW**********
created by two security practitioners, Loren Kohnfelder and Praerit Gard, at Microsoft in 1999, to assess applications and security in their methodology approach; characterizing known threats according to the kinds of exploit that are used (or motivation of the attacker). Stands for Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.
A company with multiple subsidiaries may appoint a single
data protection officer so long as they are "easily accessible from each establishment
Avoidance
decide not to engage in that behavior; avoid risk by not doing what will lead to that risk; disengage i.e., patching, not using windows, anti
Scoping and Tailoring - In step 1
decide through scoping what will and will not be included in the assessment then tailor it to filter and/or modify our approach to fit our scope objectives (i.e., iterations when doing SDLC)
Exposure
degree to which you are susceptible to asset loss due to a threat
BCP Planning begins with
developing a BCP Program - wherein we sketch out the parameters of what the program means
Administrative Controls
directive controls - policies and procedures, privilege management or monitoring
Logical (Technical) Controls
directive controls - policies and procedures, privilege management or monitoring
Deterrent Controls
discourage people from violating security directives reinforce directive controls
The GDPR regulation expressly prevents
dismissal or censure of the data protection officer for performance of his/her tasks and places no limitation on the length of their tenure
Due Diligence
doing what it takes from day-to-day to implement oversight of standards that are set, the security culture that is guided by the framework so everybody can be held accountable within that culture, and everybody is responsible for operating in the appropriate way within that culture
Asset valuation
dollar value assigned to an asset
E-Privacy Regulation
ePrivacy, ePrivacy2, PECR2, ePR
Cybercrime
engaging in criminal activity through use of a computer, a. Loss of intellectual property and sensitive data b. Damage to brand image/reputation c. Penalties and compensatory payments d. Cost of countermeasures e. regulatory and compliance issues (jail time, sensure, assets seized)
Integrity controls are not about
ensuring info is kept confidential/secret. It is impt because if the info is changed, the meaning of the info may also change
Job Rotation (personnel security/EMPLOYEE CONTROL)
ensuring people can move through different jobs in organization - enables cross training - ensure knowledge documentation
Third Party Assessment
ensuring we have visibility through some sort of audit ability, verification, validation, and assurance process to ensure that due diligence and due care are being applied.We have to have good, clean, understandable, signed off on,and agreed to SLAs, service level agreements, that are contractual vehicles.That bind both customers and suppliers, or providers, you can think of it either way,to a set of assumptions,a set of requirements
Reporting
every last step is to communicate findings and summarize effectively what you have done, timeliness and understandability
privacy management (GDPR)
exercising personal control over confidential information in order to enhance autonomy or minimize vulnerability; The regulation mandates a "Risk Based Approach:" where the appropriate organizational controls must be developed according to the degree of risk associated with the processing activities.
Standards
external guidance for industries should align with to maintain designation
Detective
finds suspicious behavior and alert you IDS
Standardization/Standards
formalized (written down) guidance that allows us to operate with a set of things we need to do in a certain way; formalized guidance and things we need to be aligned with coming from an agency and have penalty of
ISMS is a
framework of policies and procedures that includes mgmt of all legal, physical and technical controls involved in an org's info risk mgmt processes. Tells you what you should have in place but doesn't tell you how to do it - strategic level
Acceptance
going to engage in risk behavior even though there may be a downside, the cost of doing business
Risk Framework
guideline or recipe for how risk is to be assessed, resolved, and monitored. (COSO, ITIL, ISO 27001 and 27002 ISO 17799/BS 7799, ISMS (01) and Controls (02); ISO 73:2009 (risk mgmt vocab list), ISO 31010:2009 (risk mgmt techniques), ISO 31000:2018 (risk mgmt guidelines)
ISO31000
guidelines on managing risks
Security Control Frameworks
help us to structure mgmt identification of requirements goals and objectives
Policy
high level strategy or statement of events, gives direction but not details or specific approach of how to get there; they should be broad in scope and coverage; details come in supporting documentation
BCP - business continuity planning
how do what we do to get back to normal; if it's not working, we need to understand what isn't working and what it means; what steps we do to get systems working to restore continuity
OEDC 8 core principles or privacy
i. Collection limitation ii. Data quality iii. Purpose specification- what we capture data for and narrowingly defining that need iv. Use limitation- what we capture data for and narrowingly defining that need so we don't capture more than we need so as not to expose data v. Security safeguards vi. Openness vii. Individual participation viii. Data controller accountability
incidents and breaches are important because of
i. Privacy ii. Governance iii. Risk iv. Compliance
Internal Penetration Testing
important because people who know the system will know where to look for the holes, but they also will ignore certain things; or only test for compliance because even though you may meet compliance, an external tester will look for all ways to get in
High availability
involves system downtime while we failover to a new system and bring it back up (i.e., cluster)
International Wire Transfer
is Governed by the countries that use it so data remains under the laws of the agreements through the countries it travels through
Risk Value
is how we measure risk
Data Custodian
is responsible for implementing the protections called out by the security policy at the behest/direction of the data owner. Performs all activities necessary to provide CIA protection.
The ITL
is supported by NIST and publishes special publications related to security that are freely available for download here: http:// csrc.nist.gov/ publications/ PubsSPs.html.
ALE
is the $ value over a period of time (12 months/year, 6 months. Etc.)
organizational process role and responsibility
is this idea of well thought out, well defined, and communicated policies and procedures that everybody understands
Risk Assessment Goal
is to identify, catalog and mitigate risks
BCP Planning
is when one or more individuals from diff areas of an organ that get together to jointly come up with a plan that can be a set of written/documented requirements; detailed action-oriented capability that we develop in business; a story or narrative about what we should do if something isn't working; a good plan that encompasses what needs to happen and how
Right to data portability
it allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to format, usability because it mandates standardized data formats like .csv; it ensures that data is gonna be structured, stored, managed, and used in ways that make it portable so I'm not locked in to one vendor, no proprietary systems
Recital 171 of GDPR
makes clear that existing consent is O.K. if it was in line with the purpose of GDPR; you're not supposed to go out and consistently seek a renewal of consent because certain activities can be seen as being problematic for other reasons
Disclosure
making secret information public; breaks confidentiality; disclosures can happen as a result of a breach
Adverse impact
measures what a vulnerability would cost or mean if it happens
Encryption Controls
mechanisms, rules, thought processes, policies and procedures (guns, guards, gates, sing-ins, sec cameras, card access, CCTV monitoring, non-stop observation
The goal of the ISMS is to
minimize risk and ensure continuity by pro-actively limiting the impact of a sec breach and to ensure business is conducted within an acceptable level of risk (minimize risk and maximize CIA)
Mitigation
minimize the risk, engage in behavior and execute countermeasures at every opportunity (patching up to date; access control; administrative account special)
BS 7799
morphs into ISO17799 which ultimately becomes the bedrock and baseline for ISO 27001 and 27002
Defense-in-Depth Strategy
multiple layers or levels of access controls to provide layered security; a series of concentric rings that show controls overlap and mutually reinforce each other overlapping neutrally reinforcing layers of controls or counter measures to minimize risk.Remember, if one control is good, two is better, and three is better than two because they may be implemented differently in different systems, be managed and overseen by different areas of the business,we may have different vulnerabilities that we are addressing with them indifferent areas of the architecture even though they are the same.
US Privacy Shield Framework
new name for the Privacy Sheild
when a data processor experiences a personal data breach, it must
notify the controller but otherwise has no other notification or reporting obligation
COUNTER MEASURE SELECTION
offset risk, counter measures are about the things we will do in order to prevent unauthorized access to the system
Repudiation occurs when
one party in a transaction denies that the transaction took place
security frameworks are never
one size fits all. they are one size fits one; they should be used as guidance, a starting point or skeleton; they don't have to be taken verbatim but do have to be documented and implemented so we can audit, validate and verify against them; they help us to translate those ideas into what we already do without ripping and replacing everything
Guidelines
optional things, a set of best practice recommendations not forced to follow, doesn't carry the force of a regulation
Consent should be demonstrable
organizations need to be able to show clearly how consent was gained and when.
Right to be informed
our ability to be able to have our information fairly processed and managed. And as a result there is a privacy notice that is provided by companies that are either updating or have sent you or revised that you see we treat you data this way, we do these things to it. We don't sell it, we don't give it to these people
ISO2700 series
overall addresses information security management across a broad a swath of different numbered standards in this series; Organisations can achieve certification to ISO 27001 but not ISO 27002.
PCI DSS
payment card industry data security standard - credit card, prevent identity theft; applies to payment card industry, they regulated themselves
Violations of obligations related to legal justification for process (Consent)
permission for something to happen or agreement to do something; opt-in to give explicit permission to use data
Data owner
person or entity who has ultimate control over data who has access, what permissions, etc. the person who is in charge of data classification
Physical Controls
preventative and deterrent controls - things we apply to a system to prevent something from happening (doors, locks, windows, guards, dogs, etc)
Applicable types of control measures or countermeasures
preventive, detective and corrective
Strategy is not the same as
procedures
Integrity
provides assurances that data has not been modified, tampered with, or corrupted; is Change control for data - no unauthorized modification without knowledge and consent of data owner"; confidentiality and integrity depend on each other; can't have one without the other
DREAD Methodology
quantifying, comparing and prioritizing the amount of risk presented by each evaluated threat. The DREAD algorithm, shown below, is used to compute a risk value, which is an average of all five categories.
Corrective Controls
remedy circumstance, mitigate damage, and/or restore controls (attempt to fix when something has gone wrong) (corrective would be power cycling something to clear an error; a blue screen so restarting)
Work factor
represents the time and effort required to break a protective measure and it has to be large
Gramm-Leach-Bliley Act (GLBA)
requires financial institutions to ensure the security and confidentiality of customer data
Recovery Controls
restore conditions to normal after a security incident (let's try to restore after problem has happened from backup take because of a failure)
Right to Object
right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling); • direct marketing (including profiling); and • processing for purposes of scientific/historical research and statistics.
Financial Risk
risk associated with a monetary outlay; includes the initial cost of the purchase, as well as the costs of using the item or service Probability of Harm (P) x Magnitude of Harm (M) = Cost of Prevention (C)
ISO 31000:2018 ******IMPT TO KNOW*****
risk mgmt guidelines; linked to AS/NZS 4360 which underlines ISO 31000
ISO 31010:2009 ******IMPT TO KNOW*****
risk mgmt techniques
Cross border data transfers (GDPR)
safe movement of electronic, personal data around the world. ... The regulation addresses the transfer of personal data to locations outside the EU or EEA (European Economic Area)
War Dialing
searching for an idle modem by programming a computer to dial thousands of phone lines
Data Protection Directive of the GDPR is the
second part of GDPR, it's called the DPD which is designed around police and criminal justice related activities to ensure that victims of crimes, witnesses and suspects all duly protected, whatever those protections may be, under the context of an investigation through law enforcement action
non-repudiation
security principle of providing proof that a transaction did or did not occur between identified parties (i.e., a digital signature; username and password); BUT with just nonrepudiation, there is a GAP, they only know that it was my username and password or digital signature; they don't know that it was me who did it so you NEED multifactor authentication, something you have, know and are -
Security frameworks
sets of best practices and rules that drive the behavior and common language of an org; it is the over-arching thought process of how we structure and align with sec support strategy, goal, mission, and objectives of the org
Withdrawing consent should always be possible
should be as easy as giving it
Detective Controls
signal a warning when a security control has been breached (alert or warn us when something is wrong, flashing light, alarm)
ISC2 Code of Ethics*
simple code with a preamble and 4 canons -describes *what you should do*; the behavior is accepted and expected from those that act on behalf of the organ
Incident
some sort of occurrence or event that has the potential to do harm to the elements of CIA; it may or may not be negative
Corrective
something that is done when we find suspicious activity and take action to prevent it from occurring - IPS
Recovery
something we implement to fix a problem (If we can run a script that will restore functionality)
NIST documents are
standard documents numbered in the 800 series. the 1500 series updates the 800's
Procedures
step-by-step instructions for completing a task
Compensating Controls
substitute for the loss of primary controls and mitigate risk down to an acceptable level; they substitute when control is lost (redundancy, ups, backup power supplies)
Availability indicates
that data and services are available for authorized people when needed/on-demand
information security management system (ISMS) or ESA validate
that the appropriate policies, procedures, standards, and guidelines are implemented to ensure business operations are conducted within an acceptable level of risk
Fault tolerance
the ability for a system to respond to unexpected failures or system crashes as the identical component immediately and automatically takes over with no downtime (i.e., drive mirroring or a generator)
Half-Life
the amount of time it takes to break encryption that is going to be chipped away at every second of every day the encryption is in place.
We mitigate risks through
the application of controls
Cryptography
the art of protecting information by transforming it into an unreadable format, called cipher text
Likelihood ********MUST KNOW************
the chance that something might happen
Encryption only means
the data will be harder for the bad actor to decrypt; it does not mean they can't get to the data; a way of protecting data that uses a control that allows us to transform the nature of the data with a lock and key mechanism
Culture
the enduring behaviors, ideas, attitudes, values, and traditions shared by a group of people; it allows us to share information and create relevancy
Attack
the exploitation of a vulnerability by a threat agent (bad actor)
Compliance
tools or processes that are put into place to validate and verify, trust but verify; it's about that the organization is aligning with the contractual legal, industry standard or regulatory requirements (maritime (international waters), treaties, antarctic etc.)
Availability control does not mean
uninterrupted service. Some availability controls are compensating controls that allow us to restore system access, but there will be a delay of some sort (i.e., ups')
Notice is not required if "the personal data breach is
unlikely to result in a risk for the rights and freedoms of individuals
Preventive Controls
used to stop a security incident or information breach (anti-lock brakes; crash avoidance)
NIST is a
very expansive organization. It does all sorts of stuff. It is really the research and standardization of the US government when it comes to standards across all industries, Not just information security and not just IT; for IT want to look under publications, SP (special publications), see table showing the release dates, status, draft and the number, can click and download the standard pdf
NIST Cybersecurity Framework
was published in February 2014 in response to Presidential Executive Order 13636, "Improving Critical Infrastructure Cybersecurity," which called for a standardized security framework for critical infrastructure in the United States; https://www.nist.gov/cyberframework
Residual Risk ********MUST KNOW************
whatever risk that is left over after the countermeasures have been applied; ex. zero day exploits you may not know or be aware of, but that doesn't mean there is no risk) Residual Risk = Threats * Vulnerabilities * Asset Value OR Residual Risk = Total Risk - Controls
Dual Control
when two people perform a separate portion of a task at the same time as a control over the process
Acceptable levels of risk
when we can mitigate or minimize, quantify or qualify all known and documented risks; when we are willing to deal with what is left over knowing that certain risks are less impactful
Openness
willingness to try new things and be open to new experiences; we should be able to tell people what we're doing with our data and purpose specification what the expectations are for our data; transparency
5 areas of internal control of COSO necessary for disclosure objectives
⦁ Control environments ⦁ Risk assessment ⦁ The control activities - how we're going to engage in controls ⦁ Information and communication mechanisms ⦁ Monitoring
ITIL's 5 thought process areas
⦁ Service strategy ⦁ Service design ⦁ Service transition ⦁ Service operation ⦁ CSI or Continual Service Improvement then iterate back through
STEPS FOR VULNERABILITY
⦁ Vulnerability scanning - Nmap, winmap, xenmap, nrip scanner, Metasploit ⦁ Analysis - of open ports and the services that it is open for (webserver, apache, iis webserver) ⦁ Communicate results - devolve the info we find so people can understand what they need to do. Need vs. investment
Seven types/categories of access control
1) Directive 2) Deterrent (3) Preventive (4) Compensating (5) Detective (6) Corrective (7) Recovery
GRC
Governance, Risk and Compliance standards
Collection Limitation Principle
"OECD privacy guideline principle that states that personal data can be collected but limited to the purpose specified.
Encryption is the
#1 control for confidentiality; a process of encoding messages to keep them secret, so only "authorized" parties can read it (i.e., lock and key)
Hashing is the
#1 control for integrity; it Is the process of using an algorithm for verifying the integrity or authenticity of a computer file. This can be done by comparing two files bit-by-bit, but requires two copies of the same file, and may miss systematic corruptions which might occur to both files. A more popular approach is to also store checksums (hashes, message digests) of files for later comparison.
Asset Value (AV)
$$$ amount asset is worth to the organization
5 rights are associated with a copyright
(1) Reproduction of the work in any form, language, or medium (you have the right to block that from somebody who is doing that illegally, without licensing, without your approval) (2) Adapt or derive more works from it. (3) Make and distribute its copies. (4) Perform it in public. (5) Display or exhibit it in public
Prepare for assessment - Step 1
(A) Determine methodology, qualitative or quantitative. Qualitative - 3 high, med and low ratings or 5 very high, high, moderate, low, very low. Quantitative - collect statistics about things that have happened (B) Determine Scope need to know what to focus on AND what we can ignore regarding the assessment (IT as a whole, HIPAA focused, PCI-DSS) (C) Rigor we will use (D) Degree of formality we will use?
Transference
(Insurance or SLA) get someone else take on the risk for our behalf; pay someone to take on the risk in exchange for money they will manage it on your behalf (i.e., move to cloud to SASS, PASS or IS model - renting infrastructure from somebody else for a fee giving someone else the liability for managing it for you; transferring the risk to a cloud provider
M2M
(Machine to Machine) enables connected devices to communicate with each other
Declaration of Trans-border data flow
(PRIVACY) Transfer of data between countries; fast changes in technology flow of data is boundary and border-less between countries, pii. there is a physical way to control it, but not with data
Directive Controls
(administrative) do this don't do that; specify acceptable rules of behavior within an organization
ISO27001
(formally known as ISO/IEC 27001:2005) specification for an information security management system (ISMS)
AS/NZS 4360 5 Step Process *****IMPT TO KNOW****
1) Establish Context: Establish the risk domain, i.e., which assets/systems are important? 2) Identify the Risks: Within the risk domain, what specific risks are apparent? 3) Analyze the Risks: Look at the risks and determine if there are any supporting controls in place. 4) Evaluate the Risks: Determine the residual risk. 5) Treat the Risks: Describe the method to treat the risks so that risks selected by the business will be mitigated.
Definition of ISO/IEC 15408-1:2009
-1 means Revision 1 :2009 is the year it was last updated; can see table of contents, first couple of pages, the appendices, will have to buy to see guts
Privacy Principles
1) Accurate 2) up-to-date info 3) can't be disclosed to a third party unless authorized consent is given by person or statute 4) people have a right to have info corrected
Process Steps for doing a Risk Assessment
1) Approval - get sr mgmt buy-in 2) Form a Risk Assessment Team 3) Analyze Data 4) Calculate Risk 5) Coutermeasure Recommendations
Ways to Assess Whether we are in line with policies, rules and regulations on an ongoing basis
1) Audits (informal or formal; annual or semi-annual) 2) continuous monitoring 3) use automation tools and techniques 4) logging 5) automation monitoring that alerts; must have well-defined processes and procedures that get implemented, monitored and standardized in a way that can be validated
4 RISK RESPONSE APPROACHES/WAYS TO DEAL WITH RISK - ATAM
1) Avoidance 2) Transference 3) Acceptance 4) Mitigation/Reduce; can apply to any pm project
6 legal grounds under the GDPR
1) Consent, 2) Contract, 3) Legal obligations, 4) Vital interests, 5) Public interests 6) Legitimate interests;
Quantitative Risk Assessment Formulas ***IMPT TO KNOW ***
1) Cost Benefit Analysis CBA = ALE before Safeguards - ALE after Safeguard 2) Total Risk = Threats * Vulnerabilities * Asset Value 3) Residual Risk = Threats * Vulnerabilities * Asset Value 4) Residual Risk = Total Risk - Controls
Different Types of law
1) Criminal harms done to one or more organizations 2) civil - interaction between business and individual 3) administrative - day to day oversight and regulation 4) maritime 5) International
Threat Modeling Two ways to visually represent what we do with data
1) Data flow diagrams - look at how data moves through the system (PASTA and TRIKE) 2) Process flow diagram - visual representation of what we do (VAST)
Conduct Assessment - Step 2 Substeps
5 substeps; (a) Identify threat sources and events (can be negative or not negative events are incidents - want to catalog them and this is based on information from Step 1 (b) Identify vulnerabilities and predisposing conditions - things that occur that allow threats to occur or not occur; unless I check and verify I don't know and ask are there countermeasures - (c) Determine likelihood that the risks will occur, if you're not patching the likelihood of something to occur, the likelihood that those vulnerabilities will not occur (d) Determine magnitude of impact - quantitative or qualitative risk impact (number on a scale, dollar value, or a hybrid) (e) Determine risk - the sum total of Risk (the effect of threat sources, events, predisposing conditions and vulnerabilities, likelihood of occurrence and magnitude of impact)
Vulnerability ********MUST KNOW************
= weakness; an inherent weakness in an information system (i.e., policy, procedures, internal controls or implementation) ALL vulnerabilities are not equal
Data Quality
A comprehensive approach to ensuring the accuracy, validity, and timeliness of data (elminate data, minimize errors)
Compensating
A control designed to be in place so that if another control fails, that control picks up the slack and will offset the failure (anti-lock brakes/anti-collision or firewall/IDS/IPS or IDPS). ⦁ IDS is passive, detects ⦁ IPS - active, alert, can shut down
Total Risk
A risk a company faces if it chooses not to implement a safeguard, control or countermeasure
Process for Attack Simulation and Threat Analysis (P.A.S.T.A)
A seven-step process for aligning business objectives and requirements, taking into account compliance issues and business analysis. Provides a dynamic threat identification, enumeration, and scoring process. Also associated with Microsoft; Once the threat model is completed security subject matter experts develop a detailed analysis of the identified threats. Finally, appropriate security controls can be enumerated. Provides an attacker-centric view of the application and infrastructure from which defenders can develop an asset-centric mitigation strategy.
Penetration Testing
A test by an authorized outsider to do agreed upon work to actually exploit any weaknesses in systems that are vulnerable.
External Penetration Testing
A test by an outsider to actually exploit any weaknesses in systems that are vulnerable; may not need if nothing uses cloud services or AS400; if you can't guarantee you don't use it, that will be the thing that someone exploits
Zero Day Exploit
An unknown risk; a vulnerability that is exploited before the software creator/vendor is even aware of its existence.
DREAD algorithm
An used to compute a risk value; Risk_DREAD = DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 5 get a numerical value; will always produce a number between 0 and 10; the higher the number, the more serious the risk. the lower the number the less impactful
Cost-Benefit Analysis (CBA)
Analysis that compares (CBA = ALE before Safeguards - ALE after Safeguard) the costs of various possible decisions to each other, forecasts the net impact of each on the bottom line, and recommends the best alternative.
Quantitative or quantifiable Risk Formula
AnnualLossExpectancy (ALE) = SingleLossExpectancy (SLE) * Annual Rate of Occurrence (ARO) ALE=SLE*ARO
Asset
Anything of value that is owned
Other areas Penetration Testing
Application DoS/DDoS (internet sites) WAR... (driving dialing) Wireless Social Engineering Telephony - (not vlanned voip phones; little computers malware into may access across the network plugged into switch and routers)
Regulatory Risk
The risk that changes in regulations may negatively affect the operations of a company.
NIST SP800-53AR4
Assessing Security and Privacy Controls in FEDERAL Information Systems and Organizations: Building Effective Assessment Plans
ASSIGN RISK
Assign risk when you have the risk residual; senior mgmt assigns - This is the person that will manage risk on behalf of the organization; Senior management owns and bears responsibility and accountability of the risk
VAST
Associate with AGILE, Another threat modeling methodology, visual, agile, and simple threat model or modeling, that's what it's referring to
Financial Frameworks
Basel II, Sarbanes-Oxley (financial AND publically traded co's NASDAQ OR NEW STOCKEXCHANGE), COSO, GLBA
Threat modeling methodologies - History
Began in 1977; christopher Alexander; Visualization;
BSIMM
Building Security In Maturity Model (BSIMM) measures software security; Software security framework made of four domains (governance, Intelligence, SSDL Touchpoints, Deployments
ISO 15, 16,17, 18
Cloud standards
Eight Core Principles
Collection Limitation, Data Quality, Purpose, Specification, Use Limitation, Security Safeguards, Openness, Individual Participation, Data Controller Accountability
ISO15408
Common Criteria For IT Security Evaluation Framework for specification of evaluation protection profile (PP) Evaluation Assurance Level (EAL 1-7) - government and military standards - equip is certified at a certain level of security
Confidentiality countermeasures or controls
Done through Access controls (permissions) a. encryption b. traffic padding (adding random garbage in the traffic stream to make it harder for the hacker to pick out good stuff) c. strict access controls / authentication mechanisms d. data classification e. awareness training
Need to Know (risk mitigation technique)
Defines the minimum level of access for subjects based on their job or business requirements;
DODAF
Department of Defense Architecture Framework
Separation of Duties (personnel security/EMPLOYEE CONTROL)
Dividing responsibilities between two or more people to give us more insite and oversite to a control and limit fraud and promote accuracy of accounting records (ex. backups and restore; prevent one person from having all the power; similar to TWO PERSON RULE
separation of duties
Dividing responsibilities between two or more people to limit fraud and promote accuracy of accounting records (i.e., backing up data)
Copyright
Don't have to register it like a patent, can just claim it as copyrighted material; it protects published or unpublished UNIQUE/original work (for the duration of its author's life plus 50 years) from unauthorized duplication without due credit and compensation; Protects not only books but also According to the major international intellectual-property protection treaties (Berne Convention, Universal Copyright Convention, and WIPO Copyright Treaty - United Nations entity World Intellectual Property Organization, a subset of the United Nations,that governs this globally international ip)
The Wassenaar Arrangement
Dual Use Goods
Examples of due diligence (personnel security/EMPLOYEE CONTROLS)
From a Sr. mgmt perspective overseeing- need to know, least privilege, job rotation, separation of duties
Privacy Requirements
GDPR replaces Directive 95/46 EC, HIPAA, Personally Identifiable Information (PII)
Examples of governance organizations
GRC standards, US, EU Safe Harbor Framework
GDPR
General Data Protection Regulation (EU) April 27, 2016/679 (GDPR) is a regulation that ALL member states must adhere to. The GDPR in EU law on data protection and privacy in the European Union (EU) and the European Economic Area (EEA). It also addresses the transfer of personal data outside the EU and EEA areas. 173 recitals and 99 articles (the 99th is the go live date May 25, 2018; 98 articles we pay attentionto)
Security Policy
Give us direction, guidance and guidelines around what we are supposed to do; strategic in nature; high level
Collection Limitation and Purpose Specification
Go hand in hand because data needs to be collected for the specified purpose and tell you so you have knowledge
Right to rectification
Individuals are entitled to have personal data rectified if it is inaccurate or incomplete. If you have disclosed the personal data in question to third parties, you must inform them of the rectification where possible. You must also inform the individuals about the third parties to whom the data has been disclosed where appropriate.
BS 7799 Part 2 ISO 27001
Information Security Management System (ISMS)
ISACA stands for
Information Systems Audit and Control Association
ISSAP
Information Systems Security Architecture Professional
ISSEP
Information Systems Security Engineering Professional
enterprise security architecture (ESA)
Information security mgmt system (ISMS)
ISO27005
Infosec risk management; sec guides
Private Sector is more concerned with
Integrity and availability
IAPP
International Association of Privacy Professionals, internationally recognized for privacy and trans-border data flow
ISO
International Organization for Standards
Examples of Import/export controls
International Traffic in Arms Regulations (ITAR), Export Administration Regulations (EAR) and The Wassenaar Arrangement - All three these agreements classify technology as dual use goods because we can use computers and encryption algorithms to not only create secure environments but also hide nefarious activities
International Traffic in Arms Regulations (ITAR)
International traffic in arms regulations - a group of agreements countries can sign on for that govern the use of dual use goods; dual use goods
NIST SP800-12R1
Introduction to information security; good for general knowledge, framework, reference; the lower the number the older the document
ISACA
Issues standards, guidance, and procedures for conducting information system audits behind various IT framework with the most famous being COBIT
Least Privilege (risk mitigation technique (personnel security/EMPLOYEE CONTROL))
Level of access required to execute full control; Providing only the minimum amount of privileges necessary to accomplish a function (i.e., access control)
Strategic management
Long-Term Goals - (Things we will do in the future) involves creating security policies, dealing with people issues, and evaluating threats and risks
A disaster is when we hit the
MTD barrier
"Privacy Shield" Framework
Managed by the FTC sets forth Data protection requirements when transferring personal data from the European Union to the United States in support of transatlantic commerce. This replaces the previous "Safe harbor" framework.
directive
One size fits one concept; Something that guides or directs and can be interpreted differently; no standardization; no one way of doing things; especially, a general instruction from a high-level body or official.
Controller
One who or that oversees, regulates, gives guidance and directs from a management perspective the why and the how for processing personal data; they are the ones who exercise due diligence
Communicate Risks/Results - Step 3
Regardless of the type of assessment completed (Quantitative or Qualitative) the Results can be quantitative or qualitative; broadly and widely in the organization; to senior decision makers to help them understand what is involved in dealing with the risk
Privacy Act of 1974
Restricts the way in which personal data can be used by federal agencies Individuals must be permitted access to information stored about them and may correct any information that is incorrect. Agencies must ensure both the security and confidentiality of any sensitive information.
NIST SP800-37R2
Risk mgmt framework for information systems and organizations; a life cycle approach for security and privacy
Deming cycle
See Plan-Do-Check-Act Cycle (PDCA); clockwise; do is execute, check is validate, act continue or remediate; continuous improvement; iterations (i.e., patch mgmt, vulnerability assessment, risk management)
Employee controls
Separation of duties, Job Rotation and Least Privilege; mandatory vacation, split knowledge, dual control, collusion
SLA
Service Level Agreement - Transfer; are contractual vehicles that bind both customers and providers to a set of documented statements, assumptions, and operational requirements. That we both have to agree to in order to create this trust that allows us to coexist and manage within that system.But ultimately, this all boils back down to due diligence and due care due diligence in their systems to oversee, and to provide the governance, and to provide the oversight in the system so that things work the right way. We as customers have to exercise due care, we have to consume according to those rules and operate according to those rules.And we have to ensure our vendors follow that same thought process when we're managing outsourced relationships
SLR
Service Level Requirements enumeration of the requirements that help shape and structure the SLA; the details that both the provider and the customer stipulate to that go into making up the service level agreements.
Security Role
The part an individual plays in the overall scheme of security implementation and administration within an organization.
Vulnerability Management
The practice of finding and mitigating software vulnerabilities in computers and networks.
Risk ********MUST KNOW************
The probability or likelihood that a given threat will take advantage of a vulnerability and the impact if that occurs; it is the sum total, the effect of threat sources, events, predisposing conditions and vulnerabilities, likelihood of occurrence and magnitude of impact risk = threat * vulnerability
Asset Valuation
The process of assigning financial value or worth to each information asset. need to know tangible and intangible worth (asset is something that adds value to the organization); depreciate asset over three or five year life cycle; GAP
Risk Framing
The process of identifying risks, needs, answering 5 W's and H
ALE (Annual Loss Expectancy)
The total cost of a risk to an organization on an annual basis. (i.e., $3,000)
SLE (Single Loss Expectancy)
The value of the potential impact of an event when it occurs ONE time (i.e., a $ value $1,000)
Trike
Threat models are used to satisfy the security auditing to help value and profile and understand acceptable risk levels; a threat modeling process where Threat models are based on a "requirements model." The requirements model establishes the stakeholder-defined "acceptable" level of risk assigned to each asset class. Analysis of the requirements model yields a threat model form which threats are enumerated and assigned risk values. The completed threat model is used to construct a risk model based on asset, roles, actions, and calculated risk exposure.
Total Risk Formula (Quantitative Risk Assessment)
Threats * Vulnerabilities * Asset Value
RPO (Recovery Point Objective)
Time we are willing to lose or walk away from when a sys is recovered. i.e., backups occur every 15 mins., the RPO is 15 mins so if email fails, the most we will lose is 15 mins.
Information Provided at Data Collection
the identity and the contact details of the controller and DPO • the purposes of the processing for which the personal data are intended • the legal basis of the processing • where applicable, the legitimate interests pursued by the controller or by a third party • where applicable, the recipients or categories of recipients of the personal data • where applicable, that the controller intends to transfer personal data internationally • the period for which the personal data will be stored, or if this is not possible, the criteria used to determine this period • the existence of the right to access, rectify or erase the personal data • the right to data portability • the right to withdraw consent at any time • and the right to lodge a complaint to a supervisory authority
Evaluation Assurance Level (EAL)
the level of certification sought in the Common Criteria
Risk (Organizational risk)
the likelihood that a threat source will, through threat events, exploit a vulnerability or weakness and the resulting impact will occur
BIA Goals
the main goal is to look at all the services offered (i.e., phones, email, remote access, dm, w:\ drive, accounting, printing, directory services, internet) 1) Determine criticality (ranking priorities on a scale of 1 to 10); 2) Estimate max downtime BEFORE we have a crisis (MAD max allowable downtime) and max tolerable downtime (MTD max tolerable downtime); 3) Evaluate internal and external resource requirements (where we ask who needs what service i.e., color printing, wifi) - internal (system dependency) - external (ISP connection cross-over cable to network, i.e., supply chain, vendors) - If we don't know these things we cannot assess and validate in order to prioritize and recover
Key space
the number of possible random permutations of the key that could be used to decrypt the data (i.e., a password) and it has to be large
Moore's Law (Gordon Moore Intel)
the observation that computing power roughly doubles every two years while the price will get cheaper
Legitimate Interests & Direct Marketing
the processing of data for "direct marketing purposes" can be considered as a legitimate interest.
Data subject rights - data subject access request DSAR's (GDPR)
the right to a timely processing of a request to remove their information, the right for their information to be forgotten from a system or to have the personal information corrected; Controllers must inform subjects of the period of time (or reasons why) data will be retained on collection
Confidentiality, integrity, and availability***IMPT TO KNOW***
the security triad, CIA
Governance ***IMPT TO KNOW***
the system an org uses to directs and control IT security (adapted from ISO 38500) to deliver IT decisions that bring value and impact bus for stakeholders
Confidentiality helps prevent
the unauthorized disclosure of data; keep good data away from bad people; For Confidentiality to be maintained and protected in ALL forms, at rest (in storage), in use and on the wire (transmitted). Confidentiality and Integrity depend on each other. One is not effective without the other.
Profiling (GDPR)
the use of computers to combine data from multiple sources, automated collection and processing of personal data, so that we can learn more about individuals (big data, data visualization, AI, machine learning, Alexa, etc.)
data subject equals
the user
Import
to bring a product into a country which may be governed by a series of laws
Purpose of threat modeling
to provide defenders with a systematic analysis of the probable attacker's profile, the most likely attack vectors, and the assets most desired by an attacker.
