Module 01 Flashcards
(25 cards)
What is the information security triad?
Confidentiality, Integrity, and Availability
What is confidentiality
Protection of an asset from improper disclouse
What are the breaches of confidentiality and examples of these
Intentional or Accidental, accessing unauthorized channels, showing information on displayed screens
What are the effects of a confidentiality breach?
Legal penalties, , financial penalties, reputational damage
What are ways to enforce confidentiality?
Obfuscation (making something obscure, unintelligible),
Encryption (information is converted into a secret code), Masking (censor information), Tokenization (substitute an identifier)
What is integrity?
Ensuring the accuracy, precision, and trust worthiness of information system processing
What are breaches of integrity?
Unauthorized modifications
- intentional
- accidental
- transmission error
What is the effect of integrity breaches?
Damage to equipment and processes, life safety, and breach of contract
How do you ensure integrity?
Separation of duties, and digital signature
How do you enforce integrity?
Policies, access control, input validation, audit
What is availability?
Ensuring that the resource is accessible is needed
What are breaches of availability?
Intentional ( DoS, DDoS, Malware, Sabotage), Accidental (deletion of wrong file, misconfiguration)
What are breaches of availability?
Hardware and software failure, natural events and utility failure (internet)
What is the effect of lost availability?
life safety and interruption to business
How do you ensure availability?
Replication, redundancy, clustering, scalability, resiliency
How do you enforce availability?
Policies, access control and architecture
What is non-repudiation?
To establish proof that links an action to a specific identity
What are breaches of non-repudiation?
inability to link an activity to an identified user and an invalid user
What is the effect of repudiation?
Loss of trust, lack of evidence, breach of contract
How do you ensure non-repudiation?
Access controls, digital signatures
How do you enforce non-repudiation?
Policies, certificates, logging
What is due care?
Having reasonable processes in place to continually protect IT assets
What is due diligence?
The Enforcement of the principles of due care
How do you balance information security and access?
Achieve proper balance (security has reasonable access but also there’s security against the threat) even though imbalances may occur
