Section 1

Question 1

Categories of Security Controls (1.1)

Answer 1

• Technical Controls
  
  • Technologies, hardware, and software mechanisms that are implemented to manage and reduce risks
• Managerial Controls
  
  • Sometimes also referred to as administrative controls
  • Involve the strategic planning and governance side of security
• Operational Controls
  day-to-day basis
  
  • Procedures and measures that are designed to protect data on aday-to-day basis
  • Are mainly governed by internal processes and human actions
• Physical Controls
  
  • Tangible, real-world measures taken to protect assets

Question 2

Types of Security Controls (1.1)

Answer 2

• Preventive Controls
  
  • Proactive measures implemented to thwart potential security threats or breaches
• Deterrent Controls
  
  • Discourage potential attackers by making the effort seem less appealing or more challenging
• Detective Control
  
  • Monitor and alert organizations to malicious activities as they occur or shortly thereafter
• Corrective Controls
  
  • Mitigate any potential damage and restore our systems to their normal state
• Compensating Controls
  
  • Alternative measures that are implemented when primary security controls are not feasible or effective
• Directive Controls
  
  • Guide, inform, or mandate actions
  • Often rooted in policy or documentation and set the standards for behavior within an organization

Question 3

CIA Triad (1.2)

Answer 3

• Confidentiality
  
  • Ensures information is accessible only to authorized personnel (Encryption, Access control)
• Integrity
  
  • Ensures data remains accurate and unaltered (Hashing, Digital signatures, Certificates, Non-repudiation, Checksums)
• Availability
  
  • Ensures information and resources are accessible when needed (Redundancy measures, Fault tolerance)

Question 4

Non-Repudiation (1.2)

Answer 4

• Guarantees that an action or event cannot be denied by the involved parties (e.g., digital signatures)
  
  • Proof of integrity (hash, if data changes hash changes, doesnt necessarily associate data with individual)
  • Proof of origin

Question 5

Triple A’s of Security (1.2)

Answer 5

• Authentication
  
  • Verifying the identity of a user or system (e.g., password checks)
• Authorization
  
  • Determining actions or resources an authenticated user can access (Authorisation model, permissions)
• Accounting
  
  • Tracking user activities and resource usage for audit or billing purposes

Question 6

Gap Analysis (1.2)

Answer 6

• Process of evaluating the differences between an organization’s current
  performance and its desired performance
  
  • Define scope, gather data on organisation, analyse data to identify shortcomings, develop plan to bridge gap

Question 7

Zero Trust (1.2)

Answer 7

demands verification for every device, user, and transaction within the network, regardless of its origin

Question 8

To create a zero trust architecture, we need to use two different planes (1.2)

Answer 8

Control Plane, data plane

Question 9

Control plane (1.2)

Answer 9

• Control Plane: Refers to the overarching framework and set of components responsible for defining, managing, and enforcing the policies related to user and system access within an organization
  
  • Adaptive Identity: Relies on real-time validation that takes into account the user’s behavior, device, location, and more
  • Threat Scope Reduction: Limits the users’ access to only what they need for their work tasks because this reduces the network’s potential attack surface
  • Policy-Driven Access Control: Entails developing, managing, and enforcing user access policies based on their roles and responsibilities
  • Secured Zones: Isolated environments within a network that are designed to house sensitive data
  • Policy Engine: Cross-references the access request with its predefined policies
  • Policy Administrator: Used to establish and manage the access policies

Question 10

Data Plane (1.2)

Answer 10

• • Subject/System: Refers to the individual or entity attempting to gain access
  • Policy Enforcement Point: Where the decision to grant or deny access is actually executed

Question 11

Physical Security (1.2)

Answer 11

• Barricades/ bollards: prevents access, channels people through access points
• Access control vestibule: All door are normally locked (air lock system)
• Fencing: Perimeter security
• Video surveillance: CCTV cameras
• Guards and access badges
• Lighting: Leads to more security
• Sensors: Detects infrared radiation, pressure sensors, microwaves for large area, ultrasonic for reflection detection

Question 12

Deception and Disruption Technologies (1.2)

Answer 12

• Honeypots: Decoy systems to attract and deceive attackers
• Honeynets: Network of decoy systems for observing complex attacks
• Honeyfiles: Decoy files to detect unauthorized access or data breaches
• Honeytokens: Fake data to alert administrators when accessed or used

Question 13

Change management (1.3)

Answer 13

Structured approach to transitioning from a current state to a desired future state

Question 14

Change Owner (1.3)

Answer 14

• Individual or team responsible for initiating change request
• Advocates for the change, details reasons, benefits, and challenges
• Key in presenting the case for the change

Question 15

Stakeholders (1.3)

Answer 15

• Individuals or teams with a vested interest in the proposed change
• Directly impacted or involved in assessment and implementation

Question 16

Impact analysis (1.3)

Answer 16

• Integral part of the Change Management process
• Essential before implementing proposed changes
• Assesses potential fallout, immediate effects, long-term impacts
• Identifies challenges and prepares for maximizing benefits

Question 17

Backout plan (1.3)

Answer 17

Having a way to revert changes

Question 18

Technical change management (1.3)

Answer 18

Allow List

• Specifies entities permitted to access a resource

Deny List

• Lists entities prevented from accessing a resource

Question 19

Restricted Activities (1.3)

Answer 19

• Certain tasks labeled as ‘restricted’ due to their impact on system health or security

Question 20

Downtime (1.3)

Answer 20

• Any change, even minor, carries the risk of causing downtime
• Estimate potential downtime and assess its negative effects against benefits

Question 21

Service and application restarts (1.3)

Answer 21

• Some changes, like installing security patches, require service or application restarts
• Restarting critical services can be disruptive, potentially causing data loss

Question 22

Legacy applications (1.3)

Answer 22

• Older software or systems still in use due to functionality and user needs
• Legacy applications are less flexible and more sensitive to changes

Question 23

Dependencies (1.3)

Answer 23

• Interconnected systems create dependencies, where changes in one area affect others
• Mapping dependencies is crucial before implementing changes

Question 24

Documenting changes (1.3)

Answer 24

• Documenting changes provides a clear history of the what, when, and why for accountability and future reference
• Version Control
  
  • Tracks and manages changes in documents, software, and other files
  • Allows multiple users to collaborate and revert to previous versions when needed

Question 25

Public Key Infrastructure (PKI) (1.4)

Answer 25

Framework managing digital keys and certificates for secure data transfer

Question 26

*Asymmetric Encryption* (1.4)

Answer 26

- Uses two separate keys - Public key for encryption - Private key for decryption - Private key is only key that can decrypt data encrypted with public key

Question 26

*Key Escrow* (1.4)

Answer 26

- Storage of cryptographic keys in a secure, third-party location (escrow) - Enables key retrieval in cases of key loss or for legal investigations

Question 27

Symmetric encryption (1.4)

Answer 27

- Uses a single key for both encryption and decryption - Often referred to as private key encryption - Challenges with key distribution in large-scale usage

Question 28

*Encryption* (1.4)

Answer 28

- Converts plaintext to ciphertext - Provides data protection at rest, in transit, and in use - Types of encryption: - Database encryption - Transport encryption (VPN)

Question 29

Encryption algorithms (1.4)

Answer 29

DES AES

Question 30

Cryptographic keys (1.4)

Answer 30

- Determines the output - Should be kept private - Larger kets tend to be more secure - 128-bit keys common in symmetric encyption

Question 31

Key stretching (1.4)

Answer 31

- performing multiple processes - hashing a password, then creating a hash of the hash…

Question 32

Key exchange (1.4)

Answer 32

- Out of band key exchange - not sending over internet - In band key exchange - Can use different encryption techniques to send

Question 33

Trusted platform module (1.4)

Answer 33

- Specification for cryptographic functions - Cryptographic processor, persistent memory, versatile memory, password protected

Question 34

Hardware security module (1.4)

Answer 34

- Used in large environment - Securely stores cryptographic keys - Key backup

Question 35

Key management system (1.4)

Answer 35

- Local or cloud based - Manages keys from one console - associate keys with specific users

Question 36

Data privacy (1.4)

Answer 36

- Secure enclave - A protected are for secrets - often implemented as hardware processor - monitors boot process, true random number generator, real time memory encryption…

Question 37

Obfuscation (1.4)

Answer 37

- The process of making something unclear - Only visible if you know how to read it

Question 38

Steganography (1.4)

Answer 38

- Hiding data in an image - Can hide in network traffic - Can also hide in audio/ video

Question 39

Tokenisation (1.4)

Answer 39

- replacing sensitive data with non-sensitive placeholder - Common with credit card processing

Question 40

Data masking (1.4)

Answer 40

- Hiding parts of original data - May only be hidden from view

Question 41

Hashing (1.4)

Answer 41

- representing data as a short string of text - Cannot recreate data from hash - Can be a digital signature - Proves source of message - non repudiation - private key used to make signature, and public key used to verify - Hash should be unique - Collision: - when different inputs create the same output

Question 42

Practical hashing (1.4)

Answer 42

- verifying a downloaded file matches download site - Password storage - slated hash: random data added to password when hashing