IBM Cybersecurity Architecture #1: 5 Principles Flashcards
What are the 5 security principles?
- Defense in depth
- Least privilege
- Separation of Duties
- Security by Design
- KISS
Defense in Depth
Trying to create an obstacle course.
Castle example: moat, drawbridge, keep, towers, etc.
Multifactor auth, mobile device management software (right patches, right password) EDR (endpoint detection response capability, next gen antivirus software), firewalls on web server, vulnerability testing on web and app server. Access controls on the database.
NO SINGLE POINT OF FAILURE (SPOF)
Least Privilege
Only give access to people who need it and for only as long as they need it.
Constantly go back and perform audits to make sure they still need it.
Harden the system. say a webserver runs http by default, but also turns on ftp and ssh service so people can log in remotely. If you don’t absolutely need those, remove them entirely. Minimize the attack surface. Can also remove all unnecessary IDs on the system, and change the default IDs (ie change admin to another name so peopel can’t guess it)
Privilege Creep Giving people permissions they don’t need “Just in Case” which is the opposite of least priv. Should do an annual recertification campaign and make sure users need what we’re giving them.
Separation of Duties
No single point of control, force collusion from multiple bad actors to break into the system. IE two keys required.
Req > Approval > Action.
Requester is not the same as the approver. Create necessary collusion.
Secure by design
Factor security in from the beginning, design through completion. Don’t wait until application is finished to do security.
Whose job is security? Everyone from designer to administrator to user.
KISS
Security by complexity/obscurity is not good because people will just subvert the process.
If it’s harder to do the right thing than the wrong thing, people will just find shortcuts.
COMPLEXITY IS THE ENEMY OF SECURITY
Make sure defense in depth obstacle course only obstructs bad guys, not good guys.
Security by Obscurity
secrecy !== security.
Kerckhoff’s principle: crypto system should be secure if you know everything about it except the key.
We don’t want black box security because people will still break it even if they don’t know how it works.
CIA Triad
Confidentiality, integrity, availability
CIA: Confidentiality
Authorization (MFA), access control (role based access control), encryption (turn message into string of bits, then turn it back on the other side).
CIA: Integrity
An action or message is true to itself.
Need technologies to know if things have been tampered with.
Digital signatures, cryptographic functions, and MACs (message authentication codes).
It’s like blockchain, where there’s a distributed ledger we all have access to. We can always see if someone attempts to modify a record.
**
CIA: Availability
Resources should be available to authorized users.
Flooding the system with transaction requests (DoS and DDoS) will make the data unavailable.
Older technique of syn flood. Disrupt the 3 way handshake: send a syn message, just acknolwedgment back from server, and they respond with synack.
Server will reserve sources for session in anticipation. Basically the ding dong ditch of cybersecurity.
- Business context diagram
Shows relationships among different entities in the system, buyer, building, marketing team, and tradesmen (builders).
2.System context diagram
Project management in the middle, with finance, blueprints, GUI (graphical user interface), and permit system.
Example of how IT system might look.
3.Architecture overview diagram
Project database, scheduler, reports, and alerts
NIST CSF (national institute of standards cybersecurity framework)
Like the building codes for architecture, spells out
Identify: what you need to do to identify users
Protect: how you will protect things
Detect: how to detect when you have problems.
Respond: How will you respond when you’ve detected a problem.
Recover: how you will get the system back to normal.
Cybersecurity lifecycle
We want security to be done at the beginning in the risk analysis phase, not during the architecture or implementation phase.
4 As of IAM (Identity and Access Management)
Identity is your perimeter defense
Administration (what rights do you have), authentication (you are who you say you are), authorization (you can do what you want to do), and auditing (we got back and see we did the previous 3 A’s correctly).
LDAP
Lightweight directory access protocol. Database with schema for users and their permissions.
Directories and role based access for company
Most companies will have multiple directories for things like email, crm, scm, etc.
Synced directories, meta directory, or
virtual directory that knows where to find info in other directories.
meta directory where most important info is prefetched into an enterprise directory.
Admin / Identity Governance
Creating, updating, and changing account levels.
Auth is…
Something you know (password), something you have (phone), something you are (biometric face/finger print).
The best systems don’t rely on a single one of these factors (multi factor auth).
Passwordless is the way of the future.
SSO
Single sign on system.
A Single Sign-On (SSO) system is an authentication mechanism that allows users to access multiple applications or services using a single set of credentials (such as username and password). Instead of having separate login credentials for each application, users can authenticate once and gain access to all authorized resources without needing to re-enter their credentials for each application.
Authorization
What are you allowed to do?
Risked basked authorizaiton, adaptive authorization.
Location: Maybe you can do this but not from an unknown location.
Risk Based: More restrictions for important transactions, easy to check bank balance, harder to transfer funds.
Frequency: You can do something, but if do it a lot it requires more access.
Privileged Account/Access Management (PAM)
Users with root level access, sysadmin, database/network admin. People with keys to the kingdom, requires additional verficiation.
One method is to set all passwords the same thing because they have the same password for potentially dozens if not hundreds of systems.
What happens if one employee leaves the company? What happens if something goes wrong, who did it? They can all point to the other guy.
Typical practice but not the best practice, this is where PAM system comes in. Users won’t log into system, they log into PAM system, which will then give them universal access.
PAM system will automatically change passwords to other systems when admin users are done with them to keep them secure.
