Title: Cybersecurity Basics
Course: 2016FA-MCO-110-401 > Section: Module 10: Cybersecurity

Click here for a downloadable version of this document:(EXTERNAL) Cybersecurity Basics

Information Security Model

In 1991, John McCumber created a model framework for establishing and evaluating information security (information assurance) programs, now known as The McCumber Cube. This security model is depicted as a three dimensional cube-like grid comprised of information security properties or desired goals, information states and safeguards.

1. Desired Goals: The first dimension of the information security model is made up of the three information security properties. The three desired goals include: confidentiality, integrity, and availability. Use the acronym CIA to help remember these three principles.
  - Confidentiality prevents the disclosure of information for unauthorized people, resources and processes.
  - Integrity ensures that system information or processes have not been modified.
  - Availability ensures that information is accessible by authorized users when it is needed.

Chris Perrin, IT Security Consultant, provides insight on the importance of being familiar with the industry standard term, CIA. Read, "The CIA Triad".

1. Information States: Data can be stored on a hard drive, and can also be transmitted across a network or the Internet. Data can also be processed through manipulation by software. The second dimension of the information security model is comprised of processing, storage and transmission.
2. Safeguards: Technology is usually what most information technology (IT) professionals think of when contemplating solutions to the information security puzzle. Policies and procedures provide the foundation for an organization. How would you know how to configure your firewall, a technology-based solution, without the proper policies and procedures to guide you? Educating employees through security awareness training program is an absolute must so that the security measures implemented within an organization are effective.

Everything that you learn about information security can be related back to one of the cells of this three-dimensional model. For additional details regarding each dimension read the following: McCumber Cube.

Operational Model of Computer Security

The operational model of computer security is composed of different technologies. Protection is the sum of prevention (like firewalls or encryption) plus measures that are used for detection (like an intrusion detection system, audit logs, or honeypot) and response (backup incident response or computer forensics).

Protection = Prevention + (Detection + Response)

Prevention: Access Controls, Firewalls, Encryption

Detection: Audit Logs, Intrusion Detection, Honeypot

Response: Backup Incident Response, Computer Forensics

Diversity of Defense

In order for security to be effective, controls need to be implemented at different levels. For example, an organization may have a security guard monitoring the perimeter, and they may also require a biometric palm scan before entering the server room.

1. Layered security provides the most comprehensive security. Limit access to reduce threats; if attackers can penetrate one layer, diversity ensures that they cannot use the same method to penetrate other layers.
2. Obscuring information can be a way of protecting it. If an attacker does not know which operating system is running on a device, he cannot determine its weaknesses as easily.
3. Different systems of security such as keeping a system simple from the inside but complex from the outside can be beneficial.

Communications Security

Communications security is comprised of several sub-components:

- Cryptosecurity: Cryptosecurity is the component that ensures that cryptosystems are sound and being used properly.
- Transmission Security: Transmission security measures protect transmissions from interception
- Physical Security: Provides the physical measures that safeguard classified equipment, data and documents.
- Emission Security: Includes measures taken to prevent an unauthorized person from intercepting or analyzing emanations, or the electronic signals that a device may produce.

Access Control

Access control defines a number of protection schemes which can be used to prevent unauthorized access to a computer system or network. Many devices can be configured with an access control list, or an ACL, to define whether a user has certain access privileges. Just because you can log onto the corporate network does not mean that you have permission to use the high-speed color printer.

Authentication

Authentication verifies the identity of a user. The subject needs to produce: 1) a password, 2) a token or card (i.e. a badge), or 3) a type of biometric such as a fingerprint.

Authentication involves access control which deals with the ability of a subject (individual or process running on a computer system) to interact with an object (file or hardware device). If you go to an ATM for cash, you need your bankcard which is considered something you have for which and you need to know the PIN. This is an example of multifactor authentication, or requiring more than one type of authentication. The most popular form of authentication is the use of passwords.

Social Engineering

Social engineering is the art of convincing an individual to provide you with confidential information. No technology is required here, just the gift of gab. The success of social engineering plays on the fact that most individuals in the business community are customer service oriented and do their best to be of assistance. Remember, weakest link in the security chain of a company is its people.

What is Social Engineering?

- The process of convincing an individual to provide confidential information or access to an unauthorized individual.
- One of the most successful methods that attackers use to gain access to computer systems and networks.
- Exploits the fact that most people have an inherent desire to be helpful or avoid confrontation.
- Gathers seemingly useless bits of information, that when put together, divulge other sensitive information.

Watch the video, Social Engineering (1:49) to learn more about common social engineering tactics.

Watch this video on YouTube: Social Engineering | iamzuzu

Security Trends

The level of sophistication of attacks has increased, but the level of knowledge necessary to exploit vulnerabilities has decreased. The sheer volume of attacks is increasing, and for most organizations it is not a question of if, but when. As the popularity of mobile devices increases, so does mobile malware. Think about the recent popularity of social networks. It does not take very long for a technology to become popular followed closely by ways to exploit the vulnerabilities associated with the technology.

Be aware of the specific types of attacks that are on the rise:

- Unauthorized access
- Phishing
- Bots on network

Due Care and Due Diligence

When looking at the steps taken to safeguard an organization's environment, due care and due diligence are two terms that come up and are connected.

1. Due care looks at the steps an organization takes to protect the company, its resources, and its employees by having policies and procedures in place.
2. Due diligence requires that management have continual activities to ensure that protective measures are maintained and are operational. The standard here is one of a "prudent person". Would a prudent person find the activities appropriate and sincere?

Adapted from LAN153 (IT Security Essentials: Security+) created by Susan Sands, NISGTC which is licensed CC-BY 4.0

Objectives met:
- C10
- 10.2
- 10.3
- 10.4
- 10.5
- 10.6