Fundamental Security Concepts
Getting into Cyber Security? There’s a few things you should know! In this article, I’ll cover some need to know terms and ideas that will help you build some solid knowledge in cyber security!
Important Frameworks:
The CIA Triad:
CIA stands for Confidentiality, Integrity, and Availability, which are the three main focal points of security as a whole.
- Confidentiality: Keeping data private.
Having your data out in the open is no good. Your assets need to be safe and secure. For example, if you’re holding user info like SSNs, shipping information, credit car number, etc., you’d want to make sure that only people with the proper permissions are able to access it if needed, and you need to make sure that those people have strong means to login. Use Encryption, VPNs, and tokens. Do what’s needed to prevent this information from falling into the wrong hands.
- Integrity: Keeping data from being tampered with.
What good is any kind of data if it’s incorrect? If you send something across your network, how do you know if the recipient receives exactly what you sent? All of this falls under integrity. Encryption and hashing can go a long way here. You could also make use of TCP as opposed to UDP. These tools would help you with keeping data consistent and trustworthy.
- Availability: Keeping data available to those who need it.
What’s the point of even having your data if your security measures prevents access or use of it? That’s the point of Availability. Yes, your data has to be protected, but it still has to be data, and it still has to be accessible to those who need it. The trick is to dig deeper into access control and permissions.
TLDR:
- Confidentiality: Only people with authorization can see the info
- Integrity: The data can’t be changed without authorization
- Availability: The information should be accessible to those who need it
To learn a little more, I recommend checking out fortinet.com.
AAA:
AAA stands for Authentication, Authorization, and Accounting. This framework enforces security for resources on a system. It’s closely related to, and helps enforce, the CIA triad.
- Authentication: Who are you? Are you who you say you are?
Authentication is the process of checking who the user is, and confirming their identity. Remember that that the username identifies the user who you claim to be, and the password is the method of authentication. The credentials provided are compared to the credentials about the queried user profile that is stored within the data base. This information is typically just a username and password, but could use other forms of authentication as well. Check out my separate article on Authentication.
Multi-Factor Authentication (MFA) uses more than one method of authentication. This could be any combination of authentication methods, even ones that include your other devices.
- Authorization: What are you allowed to do?
Authorization is the granted permissions given to a user. If you share a device, for example, you may or may not be able to download certain files unless you’re the admin.
- Accounting: What are you doing?
Accounting keeps track of what a user is doing on a network, and how they interact with resources. Network activity is typically logged and saved for later use in case malicious activity is recognized and they need to be referenced.
TLDR:
AAA makes sure that users are allow to be there, limits their access, and keeps track of their activity.
- Authentication: Makes sure you are who you say you are. Multifactor authentication may be used.
- Authorization: Gives users the proper permissions for what they can do on the system
- Accounting: Keeps track of user activity.
NIST
The NIST Framework breaks apart the duties of information security into 5 distinct segments:
Identify: Know your Network
To properly identify, you need to know your network, open ports, webservers, public servers, cloud infrastructure, assets, attack surface, security groups, and threat response. Knowing your network and business will help with setting and following priorities.
Protect: Be prepared for malicious events
This segment does not involve what happens during an active event, but what happens before it. Have your SIEM tools properly configured, train your employees, have proper endpoint protection, integrate proper access control, etc., anything you can do to minimize your attack surface and mitigate threats.
Detect: Monitor your assets and network.
This segment encompasses the actions taken towards the proper detection of a malicious event. Not only should you be able to detect malicious activities and anomalies, but you should also be able to know what they are, what impact they can have, and how to react accordingly.
Respond: Take proper action towards threats to your system
Once you have detected something, the proper actions must be taken in order to take care of the ongoing event in a safe and timely manner. This includes containing, analyzing, and eradicating the threat.
Recover: Learn from what happened, fix damaged systems, and fix what went wrong.
This segment shows what happens after the incident is taken care of. Fix any damage that was done by the attack and fix the vulnerability to prevent the same thing from happening again.
TLDR:
- Identify: Know what environment you’re working.
- Protect: Have proper security measures set up.
- Detect: Be able to detect malicious events
- Respond: Take proper action towards a threat
- Recover: Repair systems and learn from mistakes
To learn more, go to nist.gov.
Gap Analysis:
Cybersecurity frameworks provide solid foundations and guidelines for organizations to follow, giving their security a working mold to fit into. All that’s needed is good adherence to these frameworks. It’s important for organizations to compare and contrast themselves to the framework they should be following. This is called a Gap Analysis, a procedure that will help see how close or far you are from your goals, and will help guide you to any issues that need to be fixed. This can also be done with the aid of an Auditor or a group of third-party consultants.
Gap analyses are mainly important when adopting or transitioning to a new framework, and are typically done over a few years.
Vulnerabilities, Threats, and Risks:
Get Jacob Piloto’s stories in your inbox
Join Medium for free to get updates from this writer.
The words vulnerability, threat, and risk can get jumbled around, but they are distinctly different. Here’s how:
- Vulnerability: A weak area in your systems or network that attackers can take advantage of. This can expose your organization to a threat.
- Threat: How the vulnerability could be used.
- Risk: The likelihood of a threat becoming an event because of the vulnerability. Risk also includes the impact that can result from that event.
Let’s take this for example:
Your organization does not use email filtering and has minimal employee training. One day, one of your employees receive an email, that looks like it’s coming from the IT department, requesting that they change their password. During the process, they input their current password and seemingly enter a new one, but little did they know that the email was a phishing attack, and the attackers now have that employees login information, and has access to their computer.
Lets break this down:
- The Vulnerability in this example was the lack of email filtering and minimal employee training. This left them open to the threat
- The Threat was phishing via email.
- The Risk was pretty high because of the lack of email filtering in the vulnerability section, and the lack of employee training stunted phishing awareness, and increased the risk of an event even more. On top of this, an event put an employees credentials at risk, as well as whatever other services or documents that employee had access to.
Identity access Management (IAM):
IAM refers to having information available to the right people when they need it.
IAM: Identity access Management
- Identification: All entities have an ID. This is used for logging and monitoring all activity and access rights.
- Authentication: Proving that someone really is who they say they are. This includes Multifactor Authentication (MFA).
- Authorization: Determining what rights the subjects should have on each resource.
- Access Control: Entities only get the access rights that they require
When a user joins the team, their permissions are assigned to a newly created user account, along with their name and attributes. Then, when they leave, their user account is deleted, even if they’re getting transferred or promoted. This method ensures that all users only have rights they need and only when they’re needed.
Security Controls:
Security Controls controls are the different ways that you could implement security measures in order to prevent a variety of threats.
Managerial Controls are administrative controls that are associated with frameworks and security management. This could include security policies, risk management and assessment, and reporting.
Operational Controls are implemented by the people, whether to encourage security and awareness, or to discourage break ins. This could include awareness programs, employee training, and security guards.
Technical Controls are implemented through some type of technical system. This can include firewalls, and antivirus, and the use of Intrusion detective systems (IDS).
Physical Controls are physical limitations that prevent unauthorized access. This could include fences, locks, a limited amount of doors to a room, and badge readers.
Control Types:
Where security controls cover the medium in which the security is being implemented, control types cover how security controls work. Each security control could work with each control type.
Preventative control types limits access to a resource, sets up barricades that make it harder to get in without proper authorization. This can include firewalls that block certain traffic types or locks that require a key or ID to gain access to a secure room.
Detective control types detect malicious activity, though not preventing it directly. This could include motion sensors that detect movement people who should not be at that location at that time, Intrusion Detection Systems (IDS) that detect anomalies or malicious signatures within the network traffic, or physical patrols/inspections proactively looking for suspicious or unauthorized behaviors.
Deterrent control types discourages any attempts at intrusion, though not stopping them directly. This could include warning signs that the area is under surveillance, well lit areas that make intruders feel more exposed, and security messages on applications that state it’s security and the consequences of malicious activity.
Directive control types typically a best practice or policy that is used to enforce a rule a better behavior. This could include a clear desk policy that advises employees to clear their desk of any important information or keys, user training to teach best practices, or even just word of mouth.
Compensating control types provides other, possible temporary means to control an event if your current solution is not sufficient. This could include back up generators in a power outage and blocking a vulnerable application instead of patching it.
Corrective control types control an event after it has been detected, reduce it’s impact, and continue operating with minimum downtime. This could include a fire extinguisher to put out a fire, using back ups to get back lost information, and contacting the police and making reports.
TLDR:
Security controls are different ways to implement security:
- Managerial: Implemented with administrative power
- Technical: The use of a technical system
- Operational: Implemented by people
- Physical: Physical limitations
Controls types are how the implemented security control works.
- Preventative: Limits access
- Detective: Detects possible malicious activity
- Deterrent: Discourages against malicious activity
- Directive: Encourages better behavior
- Compensating: A back up solution in case the current one is insufficient.
- Corrective: Reduces impact of an event after it happens.
For more information, I highly recommend checking out Professor Messer’s video on Security Controls.
Defense in depth:
There are many ways to implement security, but there will always be some kind of work around. Sure a lock on your door prevents people from opening it without a key, but some people know how to lockpick.
Defense in depth is the strategy of using multiple layers of security in order to cover a variety of vulnerabilities. A single layer of security is not enough, because even one strong defense might leave another vulnerability open. You need multiple layers and types of security, so it’s more challenging to adversaries. They’ll need more tools, more knowledge, and more time to carry out a successful attack. This could act as a deterrent on its own, or as a preventative for less experienced attackers.
For example, if you lock your door, someone could lock pick it and enter your house. You could use a more complex lock to make it harder to break in, but they could just find a different way all together, like breaking open your door, or even just prying open a window. By using a security system with break-in detection, it could set off an alarm and call the cops. You have dogs inside that sound scary, doorbell cameras that are known to have motion detection, a fence and bushes that would make getting in and out a lot harder, and warning signs placed on the fence. These security measures make it way harder to break in. By themselves, it isn’t much, but together, it is sure to ward off intruders with or without experience.
TLDR:
- Defense depth is the idea of having multiple layers of defense to make breaking in harder.
- Even if your solution is to strengthen a single layer, it might not cover all of your vulnerable areas.
- Defense in depth can help dieter attackers requiring more experience, tools, and time.
