Defense in Depth
Avoid, Prevent, Detect, Respond
CIA
Confidentiality, Integrity, and Availability
Principle of Least Privilege
given only those privileges needed for it to complete its task
5 steps of NIST
1. Identify
2. Protect
3. Detect
4. Respond
5. Recover
Risk Management Steps
1. identify risk
2. analyze the risk
3. Risk
assessment
4. Treat the risk
5. Monitor the risk
“known” asset
sometimes there are laws that tell us how to protect the asset
Risk response
- Avoid
- Transfer
- Mitigate
- Accept
Risk management
- Frame risks
- Assess risks
- Respond
- Monitor
Quantitative risk assessment
a process for assigning a value to an asset, the likelihood of it being compromised, and the impact of a compromise
Qualitative risk assessment
often more subjective. Risks, Likelihood, and impact are often ranked as High, Medium, or Low
Technical mechanisms to mitigate risk
• PLP
• Data Loss Prevention DLP
• Firewall
•
Encryption
• Multi-Factor Authentication MFA
• Virus scan
Processes
a set of activities that complete a specific goal
Procedure
the set of instructions for completing a process
Policies
the guidelines that dictate how processes and procedures should be carried out
Policy
highest over arching – a form set of requirements or rules – written out
Process
detailed list of steps needed to complete something
Procedure
the instructions on how to complete a specific task
acceptable usage policy
outlines what actions and behaviors are acceptable on an organizations systems, network, and within their environment
Password policies
a set of rules that passwords must meet in order to be acceptable
MFA
Multi factor authentication
data policy
a policy that describes how a business handles personal data
Data governance policy
a document that defines how an organization uses and manages its data
DLP
Data Loss Prevention
Data owner
responsible for the big picture
Data stewards
responsible for what is stored
Data custodians
responsible for the technical environment
Access control
high-level requirements that specify how access is
managed and
who may access information under what circumstances
Access control policy
data security technique that prevents unauthorized physical or remote access to company data
Discretionary
owners and admins set the policies on access rights
Role based
access is controlled based on your role within the
organization
4 main types of access control
- Discretionary
- Mandatory
- Role based
- Attribute based
Remote access policy
a policy that sets the standards for off-prem connections
VPN
an encrypted connection over the internet from a device to a network
IDS
intrusion detection systems
IPS
Intrusion prevention system
Data encryption
a method where information is encoded and can
only be accessed
or decrypted by a user with the correct encryption key
Synchronous Encryption
uses 1 key
Asynchronous Encryption
uses 2 keys