Risk Management Lecture 3

Question 1

What are the 3 main objectives of information security?

Answer 1

Confidentiality
Integrity
Availability

Question 2

How are the 3 Objectives in information Security Balanced?

Confidentiality - Integrity - Availablity

Answer 2

Depending on scenario, these 3 objectives are not balanced evenly.
For example, if enforcing 100% confidentiality put a stress on doing business negatively.

Question 3

In Regards to confidentiality, what does this entail?

Answer 3

Confidentiality measures protect information from unauthorized access and misuse.
Examples:
Encryption of data (stored and sent)
Data loss prevention
User Awareness
Non-disclosure policies
Logical Access Controls ie. No point for low lvl employees to have access to absolutely all company data

Question 4

In Regards to Integrity, what does this entail?

Answer 4

Integrity measures protect information from unauthorized alteration.
Examples
- Hashing and digital signing
- Configuration and change management
- Access Controls
Eg limiting access to certain users as read-only to ensure they cannot modify the data

Question 5

In Regards to Availability, what does this entail?

Answer 5

In order for an information system to be useful it must be available to authorized users.  Availability measures protect timely and uninterrupted access to the system. 
Example:
	- Architecture/system design with redundancy built-in
		○ RAID
		○ Clustering
		○ Load Balancing
		○ Fail-over design
		○ Data backups
		○ Dual power supplies

Question 6

What are the 3 categories of Control functionalities in information Security?

Answer 6

1. Preventive Control
   a. Stop incidents from occuring
   i. Eg Only Granting Read access to data entry employees
   2. Detective Control
      a. Identify incidents starting/during
      i. Eg. User copying lots of information off the database off site
   3. Corrective Control
      a. Fix issues after incidents
      Eg. Restoring a previous backup after hardrive failure

Question 7

In information security, what is a Control that emphasizes stopping incidents from occurring?

Answer 7

Preventive Control

Question 8

In information security, what is a Control that enphasizes detecting incidents starting/during issues?

Answer 8

Detective Control

Question 9

In information security, what is a Control that emphasizes fixing issues after incidents?

Answer 9

Corrective Control

Question 10

What are the core Principles for managing InfoSec?

Answer 10

1. Defense in depth
   a. Do not rely on single defense mechanism, its better to have numerous ones.
2. Segregation of duties
   a. Avoid stacking tasks on individuals for risk reduction purposes
   i. Eg. Putting a manager in charge of auditing their own expenditures
3. Minimum Privilege
   a. Restrict physical Access to resources
   b. Restrict Logical assess to computers/networks
   c. Base control decisions on least privilege
   i. Individuals should only be granted minimum access to resources that they require to complete their job
4. Need To Know
   a. Information only provided when necessarily for business functions
   i. Eg. No point for a janitor to know what the computers do in the rooms they’re cleaning
5. Avoid “Security by Obscurity”
   Having a key pad entry into a room with a post it note nearby with the code is probably not a good security mechanism

Question 11

Of The Core Principles for managing infosec what does Defense in depth mean?

Answer 11

The Principle of Defense in depth is to not rely on a single point of defense, always have numerous lines of defense.

Question 12

Of The Core Principles for managing infosec what does Segregation of duties mean?

Answer 12

Avoid stacking duties/tasks on individuals/small departments to reduce risk.
An example of risk would be putting a manager in charge of auditing their own expenditures.

Question 13

Of The Core Principles for managing infosec what does Minimum Privleges mean?

Answer 13

Individuals should only be granted minimum access to resources that they require to complete their job
Also
a. Restrict physical Access to resources
b. Restrict Logical assess to computers/networks
c. Base control decisions on least privilege

Question 14

Of The Core Principles for managing infosec what does Need to know mean?

Answer 14

a. Information only provided when necessarily for business functions
Eg. No point for a janitor to know what the computers do in the rooms they’re cleaning

Question 15

Of The Core Principles for managing infosec what does “Avoid Security by obscurity” Mean?

Answer 15

Trying to hide bad security does not make for good security.

Hiding a key to your front door under a floor mat at your front door for example.

Question 16

What Roles are there in regards to Data Management?

Answer 16

Data Owners
Data Custodians
System Owners
System Custodians

Question 17

What are the responsiblities of:
Data Owners
Data Custodians
System Owners
System Custodians

Answer 17

Data Owner
- Usually a business function
- Owner has responsilbity and accountablitiy associated with the data set
- Responsible for Data classification
- Possible issues organizations risk within an organization
○ Data owners having very little knowledge of their roles/responsilbities typically leading to data classifications never truly defined
○ Mission-critcual data not defined properly leading to poor security
○ Possible regulatory issues when it comes to how long a piece of data is kept

Data Custodians

- Responsible for maintaining and protecting data on a day-to-day basis
- Usually fulfilled by internal IT, but some portions of it possibly by an external entity(Amazon AWS/Azure/Google Cloud)
- Ensuring C-I-A of the data is protected and maintained

System Owner/System Custodian
- Simliar to above
Eg. Oracle Database is maintained by IT(Custodian) but HR has final say in regards to access to data as the “owner”

Question 18

Name a few Well-known Web Application Risks

Answer 18

1) Broken Access Control
2) Cryptogrpahic failures
3) Injection
4) Insecure design
5) Security misconfiguration
6) Vulnerable and outdated components
7) Id and auth failures
8) Software nd data integrity failures
9) Security logging and monitor failures
10) Server-side request forgery

Question 19

What is the point of the Common Vulnerability Scoring System(CVSS)?

Answer 19

CVSS is an industry standard for rating risk involved in technical vulnerabilties.
Version 3.1 is the current standard with numbers randing between 0 - 10

Question 20

What is the Advantage of Microsofts “patch tuesday” method of pushing patches.

Answer 20

Since organizations can plan for it, they can be prepared in advance for upcoming patches.

Question 21

Why do some organizations dislike Redhats method of pushing out patches sporatically without warning?

Answer 21

Depending on the severity of issues presented in the patch, this forces the companies to scramble and push out patches for issues with very little lead time.

Question 22

In regards to security Patching, why might a business not implement a patch in a timely manner?

Answer 22

2. But many common challenges get in the way of a business in acting immediately
   a. Sometimes the vulnerablity relies on software/hardware developers to develop the security patches
   i. Sometimes the vulnerablity was revealed before a patch was created, thus becoming a Zero day vulnerablity
   ii. Sometimes those very necessary security patches do not come out in a timely manner
   iii. Implementing patches can be disruptive and costly

Question 23

What is the most effective way of addressing vulnerabilities?

Answer 23

Implementing security patches in a timely manner is the most effective way of addressing vulnerablities

Question 24

What are 2 ways of dealing with Technical Vulnerabilties?

Answer 24

Proactive Approach

Reactive Approach

Question 25

In regards to dealing with technical vulnerabilties, what does it mean to have a proactive approach?

Answer 25

To be proactive, means to keep track of vender releases, and critical vulnerabiltiies that are made public, and start the patch procedure immediately upon discouvery.

Question 26

In regards to dealing with technical vulnerabilties, what does it mean to have a Reactive Approach?

Answer 26

a. Conduct vulnerablity scans on IT systems/applications regularly(montly/quarterly/etc)
b. Address findings with a risk-based approach
If high CVSS rating for instance

Question 27

In regards to technical Vulnerabilties,
Lets say you were running a bunch of systems with Windows XP a long since unsupported OS from Microsoft.
Lets say a huge vulnerability was discovered.
What action could you take with these machines if they were mission critical.

Answer 27

Since you cannot get rid of the systems, you could try a compensating control, for these systems, you could set them up in their own Vlan making them inaccessible from other networks.