Elements, CIA Triad, AAA Services & Protection Mechanisms
To achieve security, we need to combine 3 key pillars:
Users must understand and comply with basic data security principles:
Organizations must have a framework for:
Essential tools to protect against cyber attacks:
Computers, smartphones, routers, IoT devices
LANs, WANs, wireless networks, internet connections
Cloud services, servers, storage systems
Definition: A weakness in the security system (procedures, design, or implementation) that might be exploited to cause loss or harm.
Definition: A set of circumstances that has the potential to cause loss or harm; a potential violation of security.
Definition: An action, device, procedure, or technique that removes or reduces a vulnerability.
A human (criminal) who exploits a vulnerability commits an attack on the system. The relationship is:
Threat + Vulnerability - Control = Risk
Asset becomes unavailable or unusable. Attacks on availability.
Availability AttackUnauthorized party gains access to an asset. Attacks on confidentiality.
Confidentiality AttackUnauthorized party changes an asset. Attacks on integrity.
Integrity AttackUnauthorized party creates counterfeit assets. Attacks on authenticity.
Authenticity Attack| Category | Types | Examples |
|---|---|---|
| Human Factor | Malicious & Non-malicious | Social engineering, mistakes, insider threats |
| Environmental | Natural & Man-made | Floods, fires, power outages |
| Technical | Hardware & Software | System failures, bugs, vulnerabilities |
| Operational | Processes & Procedures | Poor practices, lack of training |
A form of threat that is unknown to the party responsible for patching or fixing the flaw. NO PRIOR KNOWLEDGE exists about this vulnerability.
The act of publishing private information and identifying information about an individual online with intent to harm.
Attacker convinces the target that they have a problem (or might have one in the future) and that the attacker is ready to help solve it.
Malware Definition: Any file or program used to harm a computer user, including worms, viruses, Trojans, and spyware.
Self-replicating code that attaches to files
Self-propagating malware that spreads across networks
Disguised as legitimate software
Secretly monitors user activity
Records keyboard inputs
Provides unauthorized access
Encrypts files and demands payment
Displays unwanted advertisements
Famous Examples: WannaCry, Petya/NotPetya, Locky, Cerber, Bad Rabbit, Ryuk, Dharma
CIA Triad: A model designed to guide policies for information security within an organization.
Keeping secrets secret
Data accuracy & consistency
Access when needed
The concept of measures used to ensure the protection of secrecy of data, objects, or resources. Prevents or minimizes unauthorized access to data.
Data encryption at rest and in transit
User IDs, passwords, 2FA
Fingerprints, iris scans, voice recognition
Hardware/software security tokens
The assurance that information is reliable and accurate. Data should not be modified by unauthorized parties.
Ensures all information is readily accessible to authorized users at all times.
| Characteristic | Definition | Example |
|---|---|---|
| Accuracy | Free from mistakes or errors | Correct user data, valid calculations |
| Authenticity | Genuine and original | Digital certificates, verified sources |
| Utility | Having value for intended purpose | Data in usable format |
| Possession | Ownership or control | Encrypted data possession vs. access |
Statement: "A breach of confidentiality always results in a breach of ownership, but a breach of ownership does not always result in a breach of confidentiality."
Answer: TRUE - If someone reads confidential data (breach of confidentiality), they now possess that information (breach of ownership). However, someone can steal encrypted data (breach of ownership) without being able to read it (no breach of confidentiality).
AAA Services: Authentication, Authorization, and Accounting/Auditing - foundational concepts for security.
Note: AAA actually refers to five elements, not just three!
Definition: Claiming to be an identity when attempting to access a secured area or system.
Example: Entering a username
Definition: Proving that you are that identity.
Example: Entering a password, biometric scan
Definition: Defining the permissions (allow/deny) of resources and object access for a specific identity.
Example: Access control lists, role-based permissions
Definition: Recording a log of events and activities related to the system and subjects.
Example: Security logs, access logs
Definition: Reviewing log files to check for compliance and violations to hold subjects accountable for their actions.
Example: Log analysis, compliance reports
Protection mechanisms are controls used to implement and maintain the CIA triad.
The use of multiple controls in a series. Like an onion with multiple layers of protection.
Used for efficiency. Similar elements are put into groups, classes, or roles that are assigned security controls, restrictions, or permissions as a collective.
The act of intentionally positioning data so that it is not viewable or accessible to an unauthorized subject.
The art and science of hiding the meaning or intent of a communication from unintended recipients.
Statement: Defense in depth is used to provide a protective multilayer barrier against various forms of attack.
Answer: TRUE
Statement: Wired Equivalent Privacy (WEP) uses a predefined shared secret key.
Answer: TRUE
Question: Which of the following is NOT part of the CIA triad?
a) Confidentiality b) Intelligence c) Integrity d) Availability
Answer: b) Intelligence
Question: What is the difference between a threat and a vulnerability?
Answer: A vulnerability is a weakness in the system that could be exploited. A threat is a potential danger that might exploit a vulnerability. Vulnerability is the "how" an attack could happen, while threat is the "who" or "what" might attack.
| Concept | Formula/Relationship |
|---|---|
| Risk Equation | Risk = Threat × Vulnerability ÷ Control |
| Security Pillars | People + Policies + Technology = Security |
| Defense in Depth | Multiple Layers = Increased Security |
| Confidentiality Breach | Always results in Possession Breach |
| Possession Breach | Does NOT always result in Confidentiality Breach |
🎭 Social Engineering Attacks
Social Engineering: An attack that relies on human interaction to trick users into breaking security procedures to gain sensitive information.
Types of Social Engineering Attacks
🎣 Phishing
Fraudulent emails resembling reputable sources to steal sensitive data.
🎁 Baiting
Lures victims with attractive offers or rewards.
📋 Pretexting
Uses fabricated scenarios to gain victim's trust and extract information.
🚶 Tailgating
Unauthorized person follows authorized person into secure area.
🌐 Pharming
Redirects users to fraudulent websites without their knowledge.
👀 Shoulder Surfing
Spying on users to obtain passwords, PINs, or other sensitive information.
Social Engineering Countermeasures
🔑 Password Policies
🏢 Physical Security
📚 Training & Awareness
🔐 Technical Controls