CYS406 · Annotated SlidesChapter 1 — Network Security Fundamentals
Chapter 1 · Annotated slides

Network Security Fundamentals

Threats, vulnerabilities, attacks and threat actors, attacker methodologies, the goals and principles of network defense (information assurance), defense approaches, administrative controls: regulatory frameworks, ISO standards, security policies and awareness training, then physical and technical controls.

Slide text Study notes Highlight: key words Tips, tricks & traps Seen again elsewhere How it can come up
Slide 1: C|ND
Exam weight Low
    Slide 2: Module Objectives Network Security Attacks
    Exam weight Low
      Slide 3: Module Objectives Network Defenses
      Exam weight Low
        Slide 4: Module Flow
        Exam weight Low
          Slide 5: Essential terminologies related to Network Security
          Exam weight Low
            Slide 6: Definitions
            Exam weight Low
            1. Threat: potential harm. Vulnerability: weakness. Attack: an attempt to exploit a vulnerability. Risk: threat × vulnerability × impact.
            Slide 7: Definitions
            Exam weight Low
              Slide 8: Types of Threat Actors
              Exam weight Low
              1. Threat actors: script kiddies, hacktivists, organized crime, nation states, insiders, cyber terrorists.
              Slide 9: Types of Threat Actors
              Exam weight Low
                Slide 10: Causes of Vulnerabilities: - Hardware or Software Misconfiguration - Insecure or poor design of network - Inherent technology weaknesses - End-user carelessness
                Exam weight Low
                1. Vulnerabilities come from misconfiguration, design flaws, unpatched software, weak policies and human error.
                Slide 11: Definitions
                Exam weight Low
                  Slide 12: Definitions
                  Exam weight Low
                    Slide 13: Slide 13
                    Exam weight Low
                      Slide 14: Slide 14
                      Exam weight Low
                        Slide 15: Slide 15
                        Exam weight Low
                          Slide 16: Slide 16
                          Exam weight Low
                            Slide 17: Slide 17
                            Exam weight Low
                              Slide 18: Slide 18
                              Exam weight Low
                                Slide 19: Examples of Wireless Network Specific Attack Techniques
                                Exam weight Low
                                  Slide 20: Attacker Hacking Methodologies and Frameworks
                                  Exam weight Low
                                    Slide 21: Importance of Network Security
                                    Exam weight Low
                                      Slide 22: Goal of Network Defense
                                      Exam weight Low
                                      1. Goal of network defense: protect information, resources and services from unauthorized access, misuse and disruption.
                                      Slide 23: Information Assurance (IA) Principles
                                      Exam weight High
                                      1. Information Assurance principles: confidentiality, integrity, availability, authentication, non-repudiation.
                                      🎯 How this can come up · 1 question
                                      MCQ

                                      Proving a sender cannot deny having sent a message is:

                                      Slide 24: Information Assurance (IA) Principles (Cont’d)
                                      Exam weight Low
                                        Slide 25: Network Defense Benefits
                                        Exam weight Low
                                          Slide 26: Network Defense Challenges
                                          Exam weight Low
                                            Slide 27: Types of Network Defense Approaches
                                            Exam weight Medium
                                            1. Defense approaches: preventive, reactive, retrospective, proactive.
                                            🎯 How this can come up · 1 question
                                            MCQ

                                            Analysing past incidents to find what went wrong is which approach?

                                            Slide 28: Network Security Controls: Administrative Security Controls
                                            Exam weight Low
                                            1. Three control families: administrative (policies, training), physical (locks, guards), technical (firewalls, encryption, access control).
                                            Slide 29: Regulatory Frameworks Compliance
                                            Exam weight High
                                            1. Regulatory frameworks: PCI DSS (cards), HIPAA (health), SOX (finance), GDPR (EU personal data), ISO 27001.
                                            🎯 How this can come up · 1 question
                                            MCQ

                                            Which standard governs organizations that process payment cards?

                                            Slide 30: Regulatory Frameworks Compliance (Cont’d)
                                            Exam weight Low
                                              Slide 31: Identifying Which Regulatory Framework to Comply
                                              Exam weight Low
                                                Slide 32: ISO Information Security Standards
                                                Exam weight Low
                                                1. ISO/IEC 27001: requirements for an Information Security Management System (ISMS); 27002: the controls.
                                                Slide 33: What is Security Policy?
                                                Exam weight Low
                                                1. Security policy: a document stating how the organization protects its assets; sets rules and responsibilities.
                                                Slide 34: Key Elements of Security Policy
                                                Exam weight Low
                                                  Slide 35: Contents of a Security Policy
                                                  Exam weight Low
                                                    Slide 36: Types of Information Security Policies
                                                    Exam weight High
                                                    1. Policy types by strictness: promiscuous (no restrictions), permissive (block known-bad), prudent (block most, allow needed), paranoid (block everything).
                                                    🎯 How this can come up · 1 question
                                                    MCQ

                                                    A policy that allows everything except known dangerous services is:

                                                    Slide 37: Internet Access Policies
                                                    Exam weight Low
                                                      Slide 38: Password Policy
                                                      Exam weight Low
                                                      1. Password policy: length, complexity, history, expiry, lockout.
                                                      Slide 39: Network Security Controls: Physical Security Controls
                                                      Exam weight Low
                                                        Slide 40: Employee Awareness and Training
                                                        Exam weight Low
                                                        1. Awareness training reduces social engineering and policy violations: people are the weakest link.
                                                        Slide 41: Security policy training teaches employees how their duties and to comply with the
                                                        Exam weight Low
                                                          Slide 42: Employee Awareness and Training: Physical Security
                                                          Exam weight Low
                                                            Slide 43: Employee Awareness and Training: Social Engineering
                                                            Exam weight Low
                                                              Slide 44: Network Security Controls: Technical Security Controls
                                                              Exam weight Low
                                                                Slide 45: Module Flow
                                                                Exam weight Low
                                                                  Slide 46: Network Security Protocols
                                                                  Exam weight Low
                                                                    Slide 47: Module Summary
                                                                    Exam weight Low