From the course: Complete Guide to Cybersecurity: A Practical Approach

Understanding the security concepts of information assurance

From the course: Complete Guide to Cybersecurity: A Practical Approach

Start my 1-month free trial Buy for my team

Understanding the security concepts of information assurance

“

- [Instructor] Let's go over some of the fundamental concepts of information assurance. And let's start with the CIA Triad. And the CIA Triad is a very relevant series of terms. One is confidentiality, integrity, and availability. And that's why you have the CIA in there. And it's extremely relevant in the purpose of information assurance and information security. Starting with confidentiality, this relates on making sure that authorized access to information is protected. So in other words, that information that is sensitive is only available to authorized users. And the number one protection for confidentiality is encryption. And I'm going to go into that in a second. Then we also have integrity, which is making sure that systems and data have not been modified by an unauthorized user or an attacker. And the number one protection to verify integrity is using hashing and hashing algorithms, and we'll get to that in a second. And then we have availability. And availability, of course, is to making sure that all systems and data are available at all times to authorized users. And of course, the number one threat for availability is a denial of service attack or a distributed denial service attack if, of course, is distributed, you know, by the attacker in the form of using compilation of compromise systems, often referred to as botnet. And a botnet is a series of compromise systems. It can be two. It can be 200. It can be 2,000. It can be 200,000 different compromise systems or bots that an attacker can control using a command and control or a C2 system. And we're going to go over around these topics in a lot more detail later in the presentation. So I mentioned that the primary way that you protect data and maintain confidentiality is by using encryption. Let's go over some of those concepts in here. I am not going to go over the different types of encryption algorithms and hashing algorithms. We will visit that later in the course. But what I want to do is at least introduce the concept of encryption at rest and where you may be protecting data in the database or you know, files store in system, and this is what we call encryption at-rest. You also have encryption in transit. That means that two systems are communicating with each other. And let's say system A is sending some data to system B and to prevent somebody like an attacker, I'll put here attacker. To steal that information or to view that information, you can perform encryption in transit and basically you will learn later about protocols like TLS or the transport layer security protocol, IPSec, and many others that can allow you to protect data. And specifically these two implementations to encrypt data in transit. There's also a third concept whenever it comes to encryption, and that is encryption in-process. And this is whenever you have a program processing data, and then that program or that system is encrypting the data to prevent unauthorized access. Now that we have reviewed the CIA triad, let's go over the methods of authentication that assist in the industry right now. And I think that everybody is familiar with at least one of these common methods of authentication, and that is knowledge-based authentication. And knowledge-based is whenever you use a passphrase or a secret, you know, of course it can be a password, a passphrase, a PIN, a personal identification number, or anything that you remember in order for you to authenticate. This type of authentication by itself is extremely vulnerable to many different attacks, and especially nowadays with the number of breaches and cyber attacks, many criminals can obtain different passwords by compromising systems and they often dump those passwords in the public domain, and then either other attackers actually use those. And the challenge is so many users reuse their passwords. And of course, if an attacker can compromise that or obtain it from a dump because of a breach, then anybody can use that password for authenticating to potentially other systems. That's why it is extremely important that you perform or you employ multifactor authentication. So basically using multiple types of authentication, and we'll get to that in a few minutes. The other type of authentication or the common method of authentication is token-based authentication. And the third one is characteristics-based authentication. And characteristics-based authentication is whenever you have some type of biometric characteristic like fingerprint, face recognition, retina scan, and many others. Now modern systems employ the multifactor authentication concepts and is using two or more factors of authentication to make that authentication system stronger. Now the more methods of authentication, so for example, combining a password with a token-based, a text message, characteristics-based authentication, or an application running in your phone, the more that you use, the stronger the authentication system is, however the potentially lower user experience will be. That's why you have to have a balance between the number of authentication methods and user experience. Now, let's go over non-repudiation. And non-repudiation is a legal term that is defined as the protection against an individual that falsely deny having performed a particular action. This provides the capability to determine whether a given individual took particular actions, such as, you know, created a specific information, approved information, or sent or received a message. Now, in today's world, a lot of these non-repudiation attacks are often in the form of impersonation or spoofing. And of course, you know, a lot of these transactions are electronic transactions. So non-repudiation can also be, because of a compromised system, then sending false information or spoofed information to another system. Now, the last concept that I want to cover here is privacy and the related laws. A privacy, of course, is a right of an individual like you or me to control the distribution of information about themselves. While security and privacy both focus on the protection of personal and sensitive information, there is a difference. With the increased rate at which data is collected and data is stored across many different industries, pretty much all industries, the push for privacy regulation and compliance has grown significantly. An example of these is the European Union GDPR or the General Data Protection Regulation. And that's an example of a law with multinational implications that apply to all organizations, foreign or domestic, doing business in Europe. Now, these laws and regulations dictate that any entity anywhere in the world handling the private data of people in a particular legal jurisdiction must abide by its privacy requirements. As a cybersecurity practitioner, you may not be required to interpret this laws in detail. However, you need an understanding on how they apply to your organization and to you as an individual.

Contents