Chapter 1: Understanding Security Fundamentals

In this chapter, we are going to look at some security fundamentals that will help you identify security threats in the system and mitigate them. With cybercrime increasing day by day, as an Information Technology (IT) professional, it is essential to first understand these fundamental concepts.

In this chapter, we will be covering the following topics:

• Security Fundamentals
• Comparing Control Types
• Physical Security Controls
• Understanding Digital Forensics

Let's start by looking at security fundamentals.

Security Fundamentals

The fundamentals of security are the foundation of protecting our assets, and there must be a strategy or methodology that we adapt for security. This is the CIA triad; let's look at its breakdown.

CIA Triad Concept

Most security books start with the basics of security by featuring the CIA triad—this is a conceptual model designed to help those writing information security policies within an organization. It is a widely used security model and it stands for confidentiality, integrity, and availability, the three key principles that should be used to guarantee you have a secure system:

Figure 1.1 – CIA triad

We'll discuss these principles in more depth here:

• Confidentiality: Prevents the disclosure of data to unauthorized people so that only authorized people have access to data. This is known as the need-to-know basis. Only those who should know the contents should be given access. An example would...

Comparing Control Types

There is a wide variety of different security controls that are used to mitigate the risk of being attacked; the three main categories are managerial, operational, and technical. We are going to look at these in more detail; you need to be familiar with each of these controls and when each of them should be applied. Let's start by looking at the three main controls.

Managerial Controls

Managerial Controls are written by managers to create organizational policies and procedures to reduce risk within companies. They incorporate regulatory frameworks so that the companies are legally compliant. The following are examples of management controls:

• Annual Risk Assessment: A company will have a risk register where the financial director will look at all of the risks associated with money and the IT manager will look at all of the risks posed by the IT infrastructure. As technology changes and hackers get more sophisticated, the risks can...

Physical Security Controls

Physical security controls are put in place to stop unauthorized access to the company or accessing the data. Physical security controls are easily identifiable as you can touch them. Let's look at each of them in turn.

Perimeter Security

In this section, we will look at different types of perimeter security systems:

• Signage: Before anyone reaches your main entrance, there should be highly visible signs warning them that they are entering a secure area with armed guards and dogs. This is used as a deterrent to prevent possible intruders.
• Fences/Gates: The first line of defense should be a perimeter fence as the openness of many sites renders them highly vulnerable to intruders. Access to the site can be controlled by using a gate either manned by a security guard or with a proximity reader. You could place bollards in front of a building to stop a car from driving through the entrance. You may even have different zones, such as a research...

Understanding Digital Forensics

Digital forensics is used by the police when they are investigating crimes and need to find digital evidence so that they can secure a conviction. We will be looking at computer- and web-based attacks.

In 2006, Forensic Process 19, proposed by NIST, consisted of four different phases: collection, examination, analysis, and reporting. Here's a diagram showing these phases:

Figure 1.6 – Forensics cycle

Let's look at each of these phases:

• Collection: Here, the data is examined, then extracted from the media that it is on, and then converted into a format that can be examined by forensic tools.
• Examination: Prior to examination, the data will be hashed, and then an investigation will be carried out with the relevant forensic tool. When the examination has concluded, the data is once again hashed to ensure that the examiner or the tools have not tampered with it.
• Analysis: When all of the forensic...

Review Questions

Now it's time to check your knowledge. Answer these questions and check your answers, found in the Solutions section at the end of the book:

1. What are the three components of the CIA triad?
2. Why might an inactive CCTV camera be placed on the outside wall of a building?
3. What does confidentiality mean?
4. How can you control access of personnel to a data center?
5. What is the purpose of an air gap?
6. Name three main control categories.
7. Name three physical controls.
8. Following an incident, what type of control will be used when researching how the incident happened?
9. How do you know whether the integrity of your data is intact?
10. What is a corrective control?
11. What type of control is it when you change the firewall rules?
12. What is used to log in to a system that works in conjunction with a PIN?
13. What is the name of the person who looks after classified data? Who gives people access to the classified data?
14. When you use a...