1_Chapter 1: Cybersecurity Introduction

Knowledge Statements

• Domain 1: Cybersecurity Concepts
• 1.1 Knowledge of cybersecurity principles used to manage risk related to the use, processing, storage and transmission of information or data
• 1.2 Knowledge of security management
• 1.3 Knowledge of risk management processes, including steps and methods of assessing risk
• 1.4 Knowledge of threat actors e.g. script kiddies, non nation state and state sponsored
• 1.5 Knowledge of cybersecurity roles
• 1.6 Knowledge of common adversary tactics, techniques and procedures
• 1.7 Knowledge of relevant laws, policies, procedures and governance requirements

Cybersecurity & Situational Awareness

• What is cybersecurity?
• "the protection of information assets by addressing threats to information processed, stored or transmitted by inter-networked information systems"
• What is the difference between IS & CS?
• Information Security deals with information regardless of format (paper, digital, physical etc)
• Cybersecurity deals with the protection of digital assets
• Cybersecurity Professionals - Situational Awareness
• All CSP must understand and manage threats
• Essential to review this in the context of the environment in which they operate
• To do this the CSP should consider:
• Business plans and business environment
• Available IT processes and diagrams
• Platforms and tools used
• Network connectivity and IT complexity
• Risk tolerance and risk culture
• Outsourcing services

NIST: 5 Functions Protecting Digital Assets

• 
• Caption: 1. IDENTIFY: use organisational understanding to minimise risk to systems, assets and data 2. PROTECT: design safeguards to limit impact 3. DETECT: identify occurrence of events 4. RESPOND: action to respond to an event 5. RECOVER: plan for resilience on compromised services

CIA TRIAD

Governance, Risk Mgmt & Compliance

• GOVERNANCE
• Board and Senior Management responsibility
• Provides strategic direction
• Ensures objectives are achieved and risk is managed properly
• RISK MANAGEMENT
• Manage risk to an acceptable level
• Internal control development
• COMPLIANCE
• Demonstrate adherence to regulations
• Contractual obligations
• Internal policy compliance

Roles & Responsibilities

• BOARD OF DIRECTORS
• Commits resources and responsibility for cybersecurity and determines if intent is met
• EXECUTIVE
• Ensures functions, resources and supporting infrastructure are properly utilised
• Acts as a key decision maker
• SENIOR MANAGEMENT
• Develops the security strategy and oversees security programmes
• Enforces policies and monitors effectiveness through metrics
• CYBERSECURITY PROFESSIONALS
• SME
• Design, implement and manage the process
• Respond to events and incidents

Cybersecurity Domains

• CYBERSECURITY CONCEPTS
• Basic risk management
• Common attack vectors and threat agents
• Patterns and types of attacks
• Policies and procedures
• Control procedures
• SECURITY ARCHITECTURE
• Common frameworks
• System topology and perimeter
• Firewalls and encryption
• Isolation and segmentation
• Monitoring, detecting and logging
• SECURITY OF NETWORKS, SYSTEMS & APPLICATIONS
• Risk Assessment
• Vulnerability management
• Penetration testing
• Control developments
• INCIDENT RESPONSE
• Incident categories
• Disaster recovery
• Business Continuity Planning
• Forensics