Security Risk Management

Page 1

The primary security goals an objectives are contained within the CIA triad

Confidentiality - Ensure data is accessible only to authorised users.

Integrity - Ensure data has not been modified by unauthorised users

Availability - Ensure data is available for authorised users

https://www.youtube.com/watch?v=432IHWNMqJE (Embed)

Page 2

Non repudiation - Ensures a subject of an activity or event cannot deny the event occurred. Digital signatures and logging can be used to provide evidence that the event or activity with no uncertainty did take place. Identification, Authentication, Authorization Auditing and Accountability measure could also be used in cases of non-repudiation

Repudiation - When an event or activity is being disposed that it ever occurred.

Protection Mechanisms:

Layering - Defence in depth multiple controls in a series as no one control can effectively mitigate all threats.

Abstraction - used for efficiency to group objects classes roles and assigned security controls (Example assigning users to groups with permissions in AD)

NIST Extract for Abstraction

A properly-administered RBAC system enables

users to carry out a broad range of authorized operations, and provides great

flexibility and breadth of application. System administrators can control

access at a level of abstraction that is natural to the way that enterprises

typically conduct business. This is achieved by statically and dynamically

regulating users' actions through the establishment and definition of roles,

role hierarchies, relationships, and constraints. Thus, once an RBAC framework

is established for an organization, the principal administrative actions are

the granting and revoking of users into and out of roles. This is in contrast

to the more conventional and less intuitive process of attempting to administer

lower-level access control mechanisms directly (e.g., access control lists

[ACLs], capabilities, or type enforcement entities) on an object-by-object

basis.”

Data Hiding - Exactly what it sounds like - preventing data being discovered by unauthorised users/applications/systems

Encryption - protecting data in storage transmit or process using an encryption algorithm

Applying Security Governance principles

Security Governance - Implementation of security solution and management methodz

Not an IT issues only, Top down approach, Policy's applied at senior management level

Security management planning

defining security roles

Strategic plan - long term 5 year plan defines security purpose, aligns to companys business goals and objectives

Tactical Plan - Used to achieve company's short terms goals

Operational plan - detailed plan based on strategic and tactical plan