Concepts of SCI Flashcards
What is the zero trust philosophy?
“trust no one, verify everything”
What are the zero trust guiding principles?
- Verify explicitly (AuthN and AuthZ on all available data pts.)
- Least privileged access (limit access with JIT/JEA, risk-based adaptive policies, data protection)
- Assume breach (segment access by network, user, device. Use encryption. Use analytics for visibility and threat detection)
What are the six zero trust foundational pillars?
- Identities
- Devices
- Applications
- Network
- Infrastructure
- Data
Describe defense in depth
A layered approach to security that uses a series of protection at each layer to slow the advance of an attack. If one layer is breached, the next will prevent unauthorized access to data.
Example layers = Physical, identity and access, perimeter, network, compute, application, data.
Describe CIA
CIA = confidentiality, integrity, and availability.
Represent security trade-offs around keeping data confidential, ensuring it’s correct, and making it available to those that need it.
Describe encryption methods
- Symmetric (same key) and Asymmetric (public + private key pairs)
Encryption of data can be ‘at rest’ and ‘in transit’,
Describe hashing.
Algorithm for converting plain text to a unique fixed-length hash value. The hash value serves as a unique identifier of the original text without needing to store the original text. e.g. used for storing passwords securely.
Describe Identity.
How someone or something can be authenticated and verified to be who they say they are.
Define identity as the security perimeter
The on-prem network is no longer the security perimeter. you now have e.g.
- SaaS applications hosted outside of the network
- BYOD accessing the network from home.
- Unmanaged devices from partners collaborating with employees.
- IoT devices in corporate networks and customer locations.
Describe the four pillars of IAM
- Administration (manage how and when to create, update. delete identities)
- AuthN (how much assurance)
- AuthZ (determine access)
- Auditing (tracking who does what, when, where, and how)
Describe modern authentication and the role of the identity provider
AuthN and AuthZ methods between client and server with the IdP.
Central IdP enables SSO, federation.
Describe federated services
Federation enables access across domains by establishing trust relationships between identity providers.
Describe compliance concepts of data residency, sovereignty, and privacy
Residency: where data can be stored, processed.
Sovereignty: data subject to laws where it is collected, held, processed.
Privacy: notice and transparency about collection, use, sharing of personal data.
Describe the shared responsibility model
Identifies which tasks are customers responsibility and which are the cloud providers.
Info and data, devices, and accounts and identities are always the customer’s responsibility.
Define authentication and authorization
Authentication: proving a person is who they say they are
Authorization: determines the level of access or permissions
