4 - Security Measure

Question 1

Is encryption only enough?

Answer 1

No.

• Weak encryption = BAD
• Compromised keys
• Denial of service

Question 2

Key data security measures

Answer 2

• Access Control/Minimisation
• Integrity/Confidentiality via encryption
• Secure access
• Recoverability
• Auditing

Question 3

Access Control Measures

Answer 3

• Separation of duties
• Least privilege
• Authentication/MFA/authorisation
• Firewall and IDS
• Logs

Question 4

SSL

Answer 4

Secure Socket Layer. Used for secure exchange of data.

The server must prove its identity to the client and is performed using public key crypto.
Data confidentiality/integrity with symmetric key

Question 5

Detecting and blocking backdoors

Answer 5

• Antivirus
• Scan attachments and downloads (verify integrity with hashes)
• Keep computers patched
• Monitor:
  —> Processes
  —> Open ports
  —> Firewall
  —> Unexplained activity
• IDS

Question 6

Ransomware defences

Answer 6

• OS patching
• Active antivirus
• Regular, offline backups (Not connected outside of backup time
• User education