CSM

What are the Specialized Areas of Security?
- Physical Security (Biometrics, Fence, CCTV)
- Personal Security (Evacuation Plan, Floor Warden)
- Operations Security(BCP plan)
- Communications Security (Encryption)
- Network Security (Firewall, IDS, IPS)

What are the Communities of Interest?
- InfoSec Community: protect information assets from threats. (Information security Managers, CISO).
- IT Community: support business objectives by supplying appropriate information technology.(CTO, IT head).
- Business Community: policy development and provision of resources.(Top Management, Department Heads).

What is CIA Triangle
– Confidentiality
– Integrity
– Availability

What are the core goals of information security and security controls?
Confidentiality, Integrity, Availability are the core goals of information security. Security controls are typically evaluated on how well they address these three core information security goals. (poor firewall).

What are the states of data?
In transmission, In Process, In Storage. CIA is needed in all these states.

What Confidentiality in the CIA?
- Confidentiality Protecting data from unauthorized access, use, disclosure
    Attacks: capturing network traffic and stealing password files or human error like leaving terminal open.
    Security Controls: encryption, access controls(only those with sufficient privileges may access certain information.
- Privacy (Related to Confidentiality)
    Layman terms: Disclosure causing embarrassment. Information is to be used only for purposes known to the data owner not disclosed to the public (e.g. Public domain information used by public/non-confidential)

What is Integrity in the CIA?
Integrity is to prevent data from unauthorize modification intentionally or non-intentionally. Integrity is the quality or state of being whole, complete, and uncorrupted.
    Attacks: viruses, unauthorized access, human Error like modifying or deleting files; entering invalid data.
    Control include: strict access control, input/function checks.

What is Availability in the CIA?
Availability is making information accessible to authorized user timely and without interference or obstruction.
    Threats: include device failure, and environmental issues (heat, static, flooding, power loss, and so on); including DoS attacks.
    Countermeasures: monitoring performance and network traffic(SNMP), using firewalls and routers to prevent DoS attacks, Redundancy.

What is AAA of CIA?
Authentication and Identification Authorization Accountability Auditing(Related Concept to Accountability).

What is Authentication and Identification in the AAA of CIA?
Authentication and Identification
- Identity is claim about who the user is.
- Providing an identity username; swiping a smart card; or positioning your face, hand, or finger for a camera or scanning
- Authentication is verifying whether claim identity is valid or not. Sometime requires additional information(password,pins) or identification is handled by other means, such as physical location
- a single two-step process. Providing an identity is the first step, and providing the authentication factors is the second step

What is Authorization in AAA of CIA?
Authorization
- Actions that authorized personnel are allowed to perform and object that user can access once the user has been identified and authenticated.
- the system evaluates an access control matrix that compares the subject, the object, and the intended activity
- Privilege Escalation Attack. (Dual segregation of duties)

What is Accountability in AAA of CIA?
Accountability
- Hold user accountable for their action.
- Depends upon strong authentication that provides assurance that every activity undertaken can be attributed to a named person or automated process. E.g: Password Sharing. Legally vulnerable.
- Passwords Vs. Multifactor Authentication Auditing(Related Concept to Accountability).
- Auditing Vs Monitoring.
- actions are tracked and recorded for the purpose of holding the subject accountable for their actions written to log which provides audit trail(history of the event).
- Auditing is needed to detect malicious actions and system failures and to reconstruct events, provide evidence for the prosecution, and produce problem reports and analysis.

What is NSTISSC Security Model?
National Security Telecommunications & Information systems security committee.

What is the six Ps?
The extended characteristics/component of information security are known as the six Ps:
    – Planning
    – Policy
    – Programs
    – Protection
    – People
    – Project Management

What is Policy?
The set of organizational guidelines that dictate certain action within the organization. In InfoSec, there are three general categories of policy:
    - General program policy (Enterprise Information Security Policy(EISP)){overall security, Roles and responsibility}
    - An Issue-Specific Security Policy (ISSP){technology=email, internet}
    - System-Specific Policies (SSP) {standards or procedures/ checklist}

What is Program
Policy is broken down into the program for implementation. Programs inside Enterprise Information Security Policy(EISP) may be Employee Security Awareness Program, implementation of the firewall.

What is Protection?
- Risk management activities, including risk assessment and control, as well as protection mechanisms, technologies, and tools.
- Finding Weakness and Strengthening.

What is People in six Ps?
- Managers need to perform a leadership role
- Mintzberg role of managers:
    - Informational Role( Provide and Receive communication)
    - Interpersonal Role (Leadership, networking)
    - Decision role (problem-solving, change management, allocate resources, negotiation)

What is Project Management in six Ps?
Project is the task of temporary nature, start and finish, goal. POLC

What is Risk Management?
1. Risk identification( Identify the threat and calculate its risk)
2. Risk Control (Deciding on what safeguards to be placed)

What is the Risk Management Process?
1st Stage: Risk Management Strategy
2nd Stage: Risk Management program
3rd Stage: Risk Management Team
4th Stage: Risk Identification

What is the Risk Management Strategy in the Risk Management Process?
1st Stage: Risk Management Strategy
- Incorporate all risk management process, activities, methodologies, and policies to support the objective of the organization i.e security needs.
- The basis for the risk management program
- Determined by Internal and External Factors
- Developed by Board of director or Management
- Constantly updated because of internal and external factors

What is the Risk Management program in the Risk Management Process?
2nd Stage: Risk Management program
- Carried out to achieve risk management strategy.
- Risk Management Program will include;
    1. Context and Purpose of the program
    2. Risk Management Team 3.Asset Identification, classification and 4.Methodology to be used

What is the Risk Management Team in the Risk Management Process?
3rd Stage: Risk Management Team
- Define the authority and responsibility of different communities of interest
- Providing adequate resources to carry out the program
- Responsibilities of these communities are:
    1. Evaluating Risk
    2. Determining control options
    3. Acquiring and installing controls
    4. Ensuring controls remain effective

What is Risk Identification in the Risk Management Process?
4th Stage: Risk Identification
- Asset Identification Types of assets:
    1. People (different employees, contractors, vendors)
    2. Procedures (Standard and Sensitive)
    3. Data (transmission, processing, and storage)
    4. Software (applications, operating system, security components)
    5. Hardware
    6. Network (Network devices, more attacked)

What is Asset Classification?
Classify the asset as per priority (Critical or non-critical) How to assign value to the asset
1. Which information asset is the most critical to the success of the organization?
2. Which information asset generates the most revenue?
3. Which information asset generates the highest profitability?
4. Which information asset is the most expensive to replace?
5. Which information asset is the most expensive to protect?
6. Which information asset’s loss or compromise would be the most embarrassing or cause the greatest liability? (Cambridge Analytics Scandals)

What is Threat identification and assessment?
process of identifying the threat that has the potential to endanger the organization. Criteria for threat assessment(impact)
1. Which threat represents the most danger to the organization. The danger depends upon
    a. Probability of threat attacking organization
    b. The frequency with which attack can occur
    c. Amount of damage that it could create
2. How much cost to recover from damages?
3. Which of threats require the greatest expenditure to prevent?

What is Vulnerability?
Vulnerability is a flaw, loophole, error in the IT infrastructure so when a vulnerability is exploited, it will cause loss/ damage to the asset.

What is the main purpose of CBA (Cost Benefit Analysis/Economic Feasibility Study)?
CBA main purpose is to select suitable safeguard based on the cost and benefit. the cost of control or safeguard include:
    – Cost of development or acquisition of hardware, software, and services
    – Training Fees
    – Cost of implementation
    – Service costs (e.g. Hiring experts)
    – Cost of maintenance (AMC or Annual Subscription) Benefit
Value to the organization because of loss prevented by using specific controls. Loss is equal to asset value is at risk. Benefit calculation begins with Asset Valuation and Impact

What is Asset Valuation?
process of assigning financial value or worth to each information asset. This can include actual cost or non-monetary cost so valuation can be difficult and asset valuation differs from one organization to other will based on following factors like:
    - cost to create or acquire, design, installation incl. maintenance
    - cost to replace i.e. right now
    - estimation or real costs protection against loss and litigation(fines and penalties) ✓ Value to owners users(critical success, profitability) ✓ worth to the competition (competitive advantage)

How to do Impact Assessment?
After assets valuation, the next step is to identify potential loss in asset occur from the Risk In order to estimate of potential loss per risk. The questions that must be asked here include:
    1. What financial impact would occur due to damage?
    2. What would it cost to recover from the attack, in addition to the financial impact of damage? (The goal here is to calculate Single Loss Expectancy for each risk. )

How to calculate Single Loss Expectancy (SLE)?
It is the estimation of loss occurred in a single asset because of a single risk.
SLE = Asset Value (AV) x Exposure Factor (EF)
Exposure Facture = % of potential loss to the organization caused by a specific threat. The exposure factor for a small asset will be less while for great value asset it will be more.

How to calculate Annual Loss Expectancy(ALE)?
ALE is the estimated yearly cost of loss of risk.
ALE = SLE(Single Loss Expectancy) X ARO(Annual Rate of Occurrence)
ARO is the expected frequency with which a specific threat or risk will occur (that is, become realized) within a single year. Higher the frequency of risk of the threat, Higher will be ARO.

How to calculate the Cost Benefit Analysis (CBA)?
Estimates, whether is a cost associated with control, is justifiable or not. It is calculated before control or safeguard is implemented, to determine if the control is worth implementing, and calculated after controls have been implemented and functioning for a time.
CBA = ALE(prior) - ALE(post) - ACS
ALE (prior to control) is the ALE of the risk before the implementation of the control. ALE (post control) is the ALE examined after the control has been in place for a period of time. ACS is the Annual Cost of the Safeguard

What are the alternatives to CBA Analysis(Qualitative Analysis)?
- Benchmarking
- Due care and due diligence
- Best business practices
- Gold standard
- Government recommendations
- Baseline

How is Benchmarking an alternative to CBA Analysis?
comparing an organization’s performance against peers and competitors in an effort to learn the best ways of conducting business or performance gap.
- How to perform benchmarking:
    - Metric Based Measures (comparison is done based on the number to measure performance like no of successful attacks, no security persons)
    - Process Based Measures ( process to attain goals)
- Two categories of benchmarks are used:
    - Standards of due care and due diligence
    - Best practices Problems with Benchmarking;
        - Lack of cooperation between organizations.
        - No two organizations are identical.
        - Limitation of resources
        - Simply knowing what was going on a few years ago doesn’t necessarily indicate what to do next.(changes in external and internal environment)

How Due care and Due diligence is an alternative to Alternatives to CBA Analysis(Qualitative Analysis)?
1. Standard of Due Care
    - When an organization must meet certain minimum levels of security in order to comply with legal requirements. ( For eg: protection of personal data)
    - CBA is not applicable for the safeguard imposed by legislation
2. Due Diligence
    - When organization have achieved a standard of due care(applied controls at or above prescribed levels)
    - monitoring that the implemented standards continue to provide the required level of protection. Legal liability if failure to maintain both

How Best Practices is an alternative to CBA?
-Best Security efforts in the overall industry.
- Benchmarking of best practices via metric based and process based.
- Should be economic feasible

How Gold Standard is an alternative to CBA?
- Recognition that an organization has achieved “best of best” performance in a certain area.
- Gold Standard is usually prescribed by the internal standard-setting body. For eg., ISO 27002 as the 'Gold Standard' in information security. (114 controls to be fulfilled to become ISO compliant)

How Government Recommendations is an alternative to CBA?
- Some industries regulated by the government. (Licensing)
- Specify requirements for the industries.

How Baselining is an alternative to CBA?
- Process of benchmarking
- Establish standard based on benchmarking/best practices against which actual performance is measured. E.g: No of attacks

What are the Risk Control Strategies?
1.Avoidance
2.Transference
3.Mitigation 4.Acceptance

What is Avoidance in Risk Control Strategies?
- Avoid doing the activity that has extreme risk.
- Process of selecting alternate options or activities that have less associated risk (http Vs https)

What is Transference in Risk Control Strategies?
Transfer risk of loss to another party or organization. For example Insurance.

What is Mitigation in Risk Control Strategies?
Reduces the impact of loss through planning and preparation. Deals with early detection and response accomplished by means of countering threats, removing vulnerabilities from assets, limiting access to assets, and adding protective safeguards. There are three common methods used to mitigate:
    - Application of policy
    - Education and training
    - Application of technology

What is Acceptance in Risk Control Strategies?
accepting the risk without control or mitigation when countermeasure costs would outweigh the possible cost of loss due to a risk and risk is low.

What is Risk Appetite?
- quantity and nature of risk that organizations are willing to accept for which no controls will be applied.
- Capacity is based on various factors like the type of business, the criticality of information assets, attitude towards risk
- balances the cost of control and risk of loss.(Higher chance of loss-Low risk appetite and higher controls)

What is Residual Risk?
Risk remains after applying Counter Measures(E.g Accounting System). The goal of information security is not to bring residual risk to zero, but to bring it in line with an organization’s risk appetite. Residual risk>Risk appetite(more controls to be applied) Residual risk< Risk appetite(excessive control may have applied)

What are the basic rules must be followed when shaping a policy?
– Never conflict with the law.
– Stand up in court.
– Properly supported and administered by top mgmt.
– Contribute to the success of the organization.
– Involve end users of information systems. (practical)

How to create a good security policy? (Bull’s Eye Model)
Layers of Bull's Eye
- Policies: the first layer of defense
- Networks: threats first meet the organization’s network.
- Systems: computers and manufacturing systems
- Applications: all applications systems

What are Policy, Standards, Guidelines, and Procedures?
Policy is a plan or course of action that influences and determine decisions. Mandatory.
Standards is detailed statement of how to use hardware, technology, software, security controls. Mandatory.
Guidelines are recommended action and guides on applying specific standard or when there are no standards. Flexible(customizable).
Procedures are is the step-by-step guide for accomplishing a task like that describes the exact actions necessary to implement a specific security mechanism, solutions(hardware deployment). Mandatory.

What are the different types of Information Security Policy?
– Enterprise Information Security Policy (EISP)
– Issue-Specific Security Policies (ISSP)
– Systems-specific Security Policies (SysSP)

What is Enterprise Information Security Policy (EISP)?
Sets strategic direction, scope, and tone for the organization’s security efforts. Executive Level document by CISO.
Guides development, implementation, and management requirements of the information security program

What is Enterprise Information Security Policy (EISP)?
EISP Components:
    1. An overview of the corporate philosophy on security
    2. Information on the structure of the information security organization and individuals who fulfill the information security role
    3. Fully articulated responsibilities for security that are shared by all members of the organization (employees(i.e., badges), contractors, consultants, partners, and visitors(i.e log book))
    4. Fully articulated responsibilities for security that are unique to each role within the organization. (HR vs Marketing)

What is Issue-Specific Security Policy (ISSP)?
focuses on the proper use technologies and department/units function like Email, Use of internet, individual department function. Different approach for Issue-Specific Security Policy (ISSP) Components of An ISSP.
1. Statement of policy
    a. Scope and applicability
    b. Definition of technology addressed
    c. Responsibilities
2. Authorized access and usage of equipment who can use the technology governed by the policy and for what purposes. Fair and responsible use.
3. Prohibited usage of equipment
    a. Disruptive use or misuse
    b. Criminal use
    c. Offensive or harassing materials
    d. Copyrighted, licensed, or other intellectual property
4. Systems management specify users’ and systems administrators’ responsibilities so that all parties know what they are accountable for. (e.gData Owners)
5. Violations of policy
    a. Procedures for reporting violations
    b. Penalties for violations
6. Policy review and modification
    a. Scheduled review of policy procedures for modification
7. Limitations of liability a.Statements of liability
    a. Other disclaimers as needed

What is Systems-Specific Policy (SysSP)?
They often function as standards or procedures to be used when configuring or maintaining systems, hardware, software. Systems-Specific Policy (SysSP) can be separated into:
1. Management guidance:
    - Created by management to guide the implementation and configuration of technology.
    - Informs technologists of management’s intent
2. Technical specifications
    - System administrator’s directions on implementing managerial policy
    - Each type of equipment has its own Technical Specifications SysSPs
    - There are two general methods of implementing such technical controls:
        – Access Control Lists
        – Configuration Rules

What is Access Control Lists (ACL)?
control access to file storage systems, object , or other network communications devices include the user access lists, matrices, and capability tables that govern the rights and privilege of users In general, ACLs regulate:
    – Who can use the system?
    – What authorized users can access?
    – When authorized users can access the system?
    – Where authorized users can access the system from?
    – How authorized users can access the system?
    – Restricting what users can access, e.g., printers, files, communications, and applications? E.g.: Firewall(Filter,block, reduce)

What is Configuration Rules?
Configuration rules are instructional codes that dictate which actions to perform on each set of information they process. Specific configuration scripts telling the systems what actions to perform on each set of information they process. Rule-based policies more specific than ACL while operating system.

What is Contingency Planning?
- Different from Risk Management Framework(Risk Management is Proactive vs Contingency Planning is Reactive)
- The goal is to restore normal business within a reasonable period of time at minimum cost.
- The main aim is to make the organization resilient.
- The Hartford insurance company estimates that, on average, over
4. percent of businesses that don’t have a disaster plan go out of business after a major loss like a fire, a break-in, or a storm

What are the components of Contingency Planning?
Business Impact analysis: Identifies the information systems that are critical for business operations and assess consequences in case of disruption of that system. High Impact System(with high requirement of information security objective) will have huge impact to business Low Impact System(with low requirement of information security objective) will have low impact to the business Its result will help in the development of the following plans:
    - Incident Response Plan (IRP)
    - Disaster Recovery Plan (DRP)
    - Business Continuity Plan (BCP)

What is Incident Response Plan(IRP)?

What is an incident?
- Directed against information assets.
- Have a realistic chance of success
- Threatens the CIA of information resources IRP deals with how to identify, mitigate and recover from those computer incidents

What is Disaster Recovery Plan(DRP)?

What is a disaster?
- Unable to mitigate the impact of an incident
- The impact is severe that organization cannot recover quickly It deals with restoring information system operation at a primary site during the emergency

What is the Business Continuity Plan(BCP)?
- Occurs when those operations cannot be quickly restored at the primary site and disruption will have long term impact.
- Enables to continue business at alternative sites like hot, warm, cold.

What are the steps of Contingency Planning?
1. Develop the CP policy statement. A formal policy provides the authority and guidance necessary to develop an effective contingency plan. Contingency Planning Management Team headed by Information Security Contingency Plan Coordinator. Include members from the business community, IT manager, Info security, legal, CIO. Related with other policies(HR, Account, etc)
2. Conduct the BIA. The BIA helps identify and prioritize information systems and components critical to supporting the organization’s mission/business processes and what will be the major consequences in case of disruption
3. Identify Resource Requirement: evaluation of the resources required to resume mission/business processes as quickly as possible. identify internal and external POCs
4. Identify Preventive Controls: identification of effective contingency planning preventive controls and maintaining these controls on an ongoing basis(Like fire suppression system, fire extinguisher, backup)
5. Creating and implementing Contingency Strategy: deals with selecting and implementing the right set of security controls. For e.g.; incident, disaster and business continuity).
6. Plan Testing, Training, and Exercises
    - Testing: determines the operability of the plan by identifying any deficiencies. Should be as close to the operating environment. (like network down, calling POC)
    - Training: deals with informing personnel of their roles and responsibilities within a particular information system contingency plan and teaching them skills related to those roles and responsibilities for preparing them for participation in exercise, test, and emergency. Done Annually.
    - Exercises: simulation of an emergency designed to validate the successful operation of components of contingency planning. (drill test)

What is Business Process and Recovery Criticality?
It is the process of determining the recovering high-impact system that is based on the following criteria:
1. Maximum Tolerable Downtime (MTD): The total amount of outage or disruption time that the system owner is willing to accept considering all impact.
2. Recovery Time Objective(RTO): The maximum time period within which the business process has to be restored to avoid unacceptable impact. (MTD vs RTO)
3. Recovery Point Objective(RPO): It is measured in time that shows an acceptable amount of loss of data that business/process can tolerate.
4. Work Recovery Time(WRT): It deals with restoring data, testing process and then making everything live for production purpose

What are the stages of Business Impact Analysis?
1. Threat attack identification and prioritization: Create Attack profile of various attack which includes, symptoms of an attack, what information systems it will impact.
2. Business Unit Analysis: Identify critical business and its supporting information system
3. Attack Success Scenario: Create a series of scenario, determining the outcome of a successful attack from each threat on critical information system
4. Potential Damage Assessment: Outcome of scenario is ranked:(low, medium, high) Attack scenario end case
5. Subordinate Plan Classification: Decide which plan to execute like IR plan(low), DR plan(medium) and BCP plan(high)

What are the stages of Incident Response Planning?
1. IR planning: For each attack scenario developed in BIA, we develop a series of predefined action scenario in a checklist.
2. Incident Detection: Incident indicators provided by human or automation system
3. Incident Reaction: Stop the incident, mitigate the impact, inform key personnel(alert rooster, alert message), documentation(learning, legal standpoint, run the simulation)
4. Incident Recovery: Damage assessment and recovery method. Includes the following activities:
    i. Identifying Vulnerabilities
    ii. Addressing Safeguards
    iii. Restoring data from backups
    iv. Monitoring the system.
    v. Inform communities of interest

What are the stages of Disaster Recovery Plan
1. Disaster Recovery Plan: Includes type of disaster and specific recovery procedures during and after each type of disaster. Roles and responsibilities
2. Crisis Management: Creating Crisis Management team and creating a command center. Two Functions:
    a. Accounting for everyone/supporting personnel.
    b. Activating alert rooster.
    c. Keeping public/management inform
3. Recovery Scenarios: Restore the system to full operation. If the primary site destroyed BCP is initiated.

What are the stages of the Business Continuity Plan?
BCP used in multinational companies that small companies
1. Plan for continuity of operation Deals with finding temporary facilities equipped with the necessary resources to run critical function to continue the business.
2. Continuity Strategies Different Options based on cost:
    a. Hot Sites: Duplicates computing resources, peripherals, phone system application. Most Expensive.
    b. Warm Sites: Contains equipment like a store. Restore backup. Takes time to be fully operational.
    c. Cold Sites: the only empty room with standard heating, air-conditioning. Least expensive.
3. Continuity management Provision of above sites via mutual agreement, paying for a vendor.

What is Law Enforcement Involvement in Contingency Planning?
Attacks deal with the violation of law decide what type of law enforcement after taking legal counsel necessary. Advantages:
1. Better able to process evidence
2. Issues warrant/subpoenas to obtaining witness, suspect statement Disadvantages:
    - Loss of control
    - Lack of information
    - Loss of equipment

What is the Sphere of Security?
Technical Control enables policy enforcement where human behavior is difficult to regulate.

What is Access Control?
Regulates the physical(external) and logical access(built-in the system) of users into trusted areas of the organization like physical devices, system resources. Collection of policies, programs, and technical control. Three models (approach) of Access Control:
1. Mandatory Access Control
    - to protected highly classified data.
    - used by government oriented agencies that maintain top-secret information
    - greatly reduces the amount of rights, permissions, and functionality a user has for security purposes. (user can’t install any programs, change file permission)
2. Discretionary Access Control
    - enables the owner of the resource to specify which subjects can access specific resources.
3. Non-Discretionary (Role Based) Access Control
    - The access rights are given to the individuals on the basis of function they have to perform. For eg, IT admin role, managerial role.
    - Best in the organization with high employee turnover
    - based upon the necessary operations and tasks a user needs to carry out to fulfill his/her responsibilities in an organization. (least privilege principle)

What are the elements of Access Control?
1. Identity
2. Authentication
3. Authorization
4. Accountability
1. Identity: is a claim that is given by User ID in the information system. It must be unique

What is Authentication?
process of validating a user identity There are four types of authentication mechanisms:
    - Something You Know: a password, passphrase, or some other unique authentication code like PIN.
    - Something You Have: on basis of something that the user possesses. (a card,key, or token)
    - Something You Are: identity based on a unique physical attribute that is evaluated by biometrics like fingerprint, facial recognition
    - Something You Produce: action performed by users, like signature recognition and voice recognition. A strong authentication uses at least two different authentication mechanism types.(two-factor or multifactor authentication)

How to evaluate Biometrics?
Biometric technologies are generally evaluated according to three basic criteria:
    – The false reject rate (FRR) /False Negative/ Type I Error: the percentage of authorized users who are denied access
    – not a threat to security
    – The false accept rate (FAR)/False Positive/ Type II Error: the percentage of unauthorized users who are allowed access
    – a serious breach of security
    – The crossover error rate (CER): the point at which the number of false rejections equals the false acceptances
    – an optimal outcome

What is Authorization?
Establish whether the user is authorized to access the particular resource and what actions he is permitted to perform on that resource. In general, authorization can be managed by:
    – Authorization for each authenticated user (complex and resource-intensive).
    – Authorization for members of a group (most commonly used method).
    – Authorization across multiple systems (‘single sign-on’)a central authentication and authorization system verifies entity identity and grants authorization.

What is Accountability?
Ensure users are accountable for their actions, Reviewing logs to reconstruct events i.e., track bad deeds back to individuals, detect intrusions.

What is a Firewall?
In information security, a firewall is any device that prevents a specific type of information from moving between two networks, often the outside, known as the untrusted network (e.g., the Internet), and the inside, known as the trusted network.
The firewall may be a separate computer system, a service running on an existing router or server, or a separate network containing a number of supporting devices(DMZ).

What are the different Firewall Architectures?
1. Packet filtering Router First generation firewall. Packet filtering is a firewall technology that makes access decisions based upon header information of the packet. Header values include source and destination IP address, port numbers, protocol types, on the basis of which inbound and outbound traffic is controlled by the firewall. The main disadvantage is that they only inspect the header of the packet but not content, as well as header, can be spoofed.
2. Screened-host firewalls Screened-host firewall systems combine the packet filtering router with a separate, application proxy server known as a bastion host.
    – The router is used to screen packets to minimize the network traffic and load on the internal proxy.
    – The application proxy examines an application layer protocol, such as HTTP, Mail and performs the proxy services.
    – This separate and single host, which is often referred to as a bastion host, represents a rich target for external attacks and should be very thoroughly secured.
3. Dual-homed host firewalls A dual-homed host architecture is built around the dual-homed host computer with two network interface: one that is connected to the external network, and one that is connected to the internal network. Use a dual-homed host as a firewall, you disable this routing function. A user wishing to access the trusted network from the Internet would log into the dual-homed host first, and then access the trusted network from there.
4. Screened-subnet firewalls
    - The screened-subnet firewall consists of one or more internal bastion hosts located behind a packet filtering router, with each host protecting the trusted network. This raises the level of difficulty to penetrate the defense.
    - One of the general models (in Figure 9-8) shows connections are routed as follows:
        – Connections from the outside or untrusted network are routed through an external filtering router
        – Connections from the outside or untrusted network are routed into—and then out of—a routing firewall to the separate network segment known as the DMZ
        – Connections into the trusted internal network are allowed only from the DMZ bastion host servers

What are Intrusion Detection Systems (IDSs)?
Tool for detecting unauthorized use of, or attack upon, a computer, network, or telecommunications infrastructure to mitigate damage by sending an alert on a network manager’s screen, or e-mail or even reconfiguring a firewall’s ACL setting. IDS have 3 components:
    - Sensors: collect network traffic and user activity data.
    - Analyzer: determines suspicious activity based on rules.
    - administrator’s interface: the terminal where sends an alert Like firewall systems, IDSs require complex configurations to provide the level of detection and response desired.

What is a Host-Based IDS?
installed on individual workstations and/or servers to watch for inappropriate or abnormal activity usually used to provide alerts if users have delete system files, reconfigure important settings, or put the system at risk in any other way(e.g system folder). Reactive HIDS products are installed only on critical servers, not on every system on the network, because of the resource overhead and the administration hassle that such an installation would cause.

What is a Network-Based IDS?
monitor network traffic when unusual activity occurs and then notify the appropriate administrator. (Packet sniffer) network IDPSs require a much more complex configuration and maintenance program than do host-based IDPSs. (E.g Network intefaces) proactive nature(because generating an alert in real time)

What is Knowledge or Signature-based Intrusion Detection?
IDS vendor accumulate knowledge about different attacks and how they are carried out and develop a model known as Signatures. Each identified attack has a signature, which is used to detect an attack in progress or determine if one has occurred within the network. (land attack) Their effectiveness depends IDS is weak against new types of attacks as signatures are based on previously identified attack.

What is Statistical Anomaly–Based IDS?
Knows as Behavioral-based IDS where it first collects data from network traffic and establishes a baseline. It then periodically samples network activity, based on statistical methods, and compares the samples to the baseline.
When the activity falls outside the baseline parameters (known as the clipping level), the IDS notifies the administrator. advantage of this approach is that the system is able to detect new types of attacks whose signature or fix has not been developed yet because it looks for the abnormal activity of any type. Disadvantage it is difficult to define what is normal when the network is constantly changing, it will create a lot of false positives. (attacker integrate his activities).

What is Remote Authentication Dial-In User Service (RADIUS) & Terminal Access Controller Access Control System (TACACS)?
RADIUS and TACACS are systems that authenticate the credentials of users who are trying to access an organization’s network via a dial-up connection. RADIUS has a central RADIUS server that centralizes the management of user authentication.
A Remote Authentication Dial-In User Service (RADIUS) system centralizes the management of user authentication by placing the responsibility for authenticating each user in the central RADIUS server.
When a Remote Access Server (RAS) receives requests for a network connection from a dial-up client, it passes the request along with the user’s credentials to the RADIUS server; RADIUS then validates the credentials.

What is Law and Ethics in Information Security?
- Laws: rules enforced by government to maintain certain behavior in society. (mandatory).
- Ethics: define socially acceptable behavior based on cultural mores.
- Cultural mores: relatively fixed moral attitudes or beliefs of a particular group.
- Difference: laws carry sanctions (enforcement)of a governing authority but ethics does not. Law is enforced and ethics come from within Belief vs Idea. (lack of cybersecurity awareness).

What are the types of Law?
- Civil law: represents a wide variety of laws that govern a nation/state.
- Criminal law: addresses violations harmful to the society that is punishable by the law.
- Tort law: a subset of civil law that allows individuals to seek recourse against others in the event of personal, physical, or financial injury.
- Private law regulates the relationships among individuals and organizations, and encompasses family law, commercial law, and labor law.
- Public law law affects the general public. All the citizens have to follow. For e.g., criminal, administrative, and constitutional law.

What is Policy as Law?
Policies serve as organizational laws. Unlike law, however, ignorance is an acceptable defense. Therefore to be enforceable as law, policies must be:
    - Distributed to all individuals who are expected to comply with them.
    - Readily available for employee reference.
    - Easily understood, with multilingual translations and translations for visually impaired or low-literacy employees.
    - Acknowledged by the employee, usually by means of a signed consent form.
    - Uniformly enforced for all employees.

What is Ethics and Information Security?
Cultural differences create difficulty in determining what is and is not ethical.
- Difficulties arise when one nationality's ethical behavior conflicts with ethics of another national group.
- Overriding factor in leveling the ethical perceptions within a small population is education.
- Employees must be trained in expected behaviors of an ethical employee, especially in areas of information security.

What is Deterrence to Unethical and Illegal Behavior?
Three causes of unethical and illegal behavior(Ignorance, accident, intent) Deterrence is the best method for preventing an illegal or unethical activity.
Examples of deterrents include laws, policies, and technical controls. However, organization laws/policies and their associated penalties only deter if three conditions are present:
    - Fear of penalty
    - Probability of being caught
    - Probability of penalty being administered

What is Organizational Liability?
If an employee, acting with or without the authorization, performs an illegal or unethical act, causing some degree of harm, the organization can be held financially liable for that action.
An organization increases its liability (legal obligation) if it refuses to take measures known as "due care" that is to make sure that every employee knows what is acceptable and what is not, and the consequences of illegal or unethical actions(policy, training)
"Due diligence" requires that an organization make a valid and the ongoing effort to maintain due care."

What is Audit Risk and Materiality?
Materiality: Significance amount/ severe impact on CIA. Risk-Based Audit focus on material threats. Types of Audit Risk Inherent Risk: Risk that occurs because of the nature of business. (Banks, Heath Sector).
Control Risk: the Material threat that cannot be prevented or detected on a timely basis by controls. (manual log review vs SIEM).
Detection Risk: Material error/lapses in IT security not detected by auditor. Inherent Risk and Control Risk Vs Detection Risk.

What are Evidence and Conclusion?
Two types of audit conclusion/opinion. (Qualified Vs Unqualified). Audit conclusion/opinion should be supported by Evidence Evidence is collected from:
    1. IS audit observations.
    2. Interview or correspondence with different parties.
    3. Audit Test procedures( Pen testing) Evidence should be:
        - Valid and relevant.
        - Complete.

What is Internal Controls?
Risk Management tool applied within the organization Composed of policies, procedures, practices, technical controls, and organizational structures. Automatic and Manual Two key purposes:
1. To achieve business objectives
2. To avoid bad thing happening(minimize the risk of error/omission/fraud) Types of Internal Controls;
    - Preventive: Detect problems before they arise (Example: Encryption, access control).
    - Detective: Detect and report errors (Example: Reviewing logs).
    - Corrective: Identify error, Minimize impact (Example: Contingency planning, backup Res.).

What is IT Audit Process?
1. Planning:
    - determine the objectives and scope of the audit.
    - Risk Assessment:
        - Evaluate risk and internal controls.
        - Compliance and Substantive testing.
        - Developing checklists.
    - Scheduling( avoiding personnel absences and times of high activity).
    - Kick off meeting(Interviews with the clients, point of contact, reporting mechanism).
2. Fieldwork and Documentation:
    - Apply checklist i.e. carry out audit procedures.
    - Determine risk and lapses in internal controls=Findings.
    - Documentation(Working papers):
        - arrive valid conclusion?
        - defense if the conclusion is challenged.
        - learn from the experience.
3. Issue Discovery and Validation:
    - Report findings like potential risky issues, lacking mitigate controls.
    - Timely reporting(correction timely and avoid confusion).
4. Solution Development Three ways to provide a solution:
    - Recommendation Approach (Auditor Recommends but may not be effective).
    - Management-Response Approach (Auditor report issue with or without recommendation asking for management response)
    ution Approach(Client and auditor mutually agree on an action plan).
5. Report Draft and issuance:
    - Audit Report two purposes( Auditor’s Record, Business Report Card)
    - Elements of Audit Report
        - Statement of Audit Scope(what areas were covered in audit).
        - Executive Summary( Brief summary of audit report highlighting major issues and action plan).
        - List of issues and action plans(layman terms).
        - conclusion(satisfactory, unsatisfactory or needs improvement).
    - distribute reports (for response).
6. Issue Tracking:
    - Audit Closure?
    - track and follow up on issues until they are resolved.
    - Escalation (Final resort).
    - Validation .e.g. BCP plan.

What is Audit Trail?
A chronological record of any event or activities (log) Three types of logs:
    1.System Logs: record events executed on an operating system, including miscellaneous events and those generated during system startup like hardware and controller failures.
    2. Application Logs: record the events regarding access to the application . For e.g., events include reading, editing, deleting, or printing files.
    3. Security logs track security-related events like logon and logoff times and changes to access rights.

What is Project Management?
Project management is techniques to plan, organize, and monitor the project activities. Hence Project management is a process that is composed of:
    1. Planning: Begins with a goal, sets standard (time, resources), suitable project leader and team.
    2. Monitoring and Controlling: Proactive Measure of the performance of the project against the standard.
    3. Closing: Project is terminated.

What is Project Plan Development?
Three core elements are used in the creation of a project plan: work time, resources, project deliverables Project.
    Deliverables: are outcomes that are demonstrable. it's a product, a process, a policy, or some other outcome. This specifies the roadmap of the project.
    Resources: includes people, equipment, supplies, materials, software, hardware depending on the project that needs to be quantified. (constraint or budget).
    Work Time: fixing start and deadline of the project which realistic based on its’ scope.

What are the Project Planning Considerations?
Special considerations include:
    - Finance (Budget, CBA).
    - Priority (Priority of work package is determined by No of dependencies and Resource(experts) availability).
    - Time And Schedule (Estimating a project schedule(PERT, GANTT chart)).
    - Staff (Need to hire/employ enough qualified, trained, and other personnel).
    - Procurement (purchasing goods or services from vendors, contractors, suppliers. Limited by Budget Constraints).
    - Organizational Feasibility (Plan for change management like new policies, processes, technology and these can create tension and resistance).
    - Training.

What is the Work Breakdown Structure(WBS)?
It breaks down the project scope into manageable deliverables known as work packages.