Introduction xiii
1 Security and Privacy Foundations 1
Security 101 1
Confidentiality, Integrity, and Availability (CIA) 3
Disclosure, Alteration, and Destruction (DAD) 4
Authentication, Authorization, and Accounting (AAA) 5
Privacy in the Modern Era 6
Foundational Privacy Principles 8
Security and Privacy Frameworks 11
Security and Privacy Policies: Creation and Enforcement 14
Establishing Security Awareness Programs 16
Security Strategies 19
2 Governance, Risk Management, and Compliance 23
The Role of Governance in Security and Privacy 23
Key Regulations and Standards 26
Regulatory Compliance 29
Building and Managing a Risk Management Framework 32
Managing Third-Party Risks and Vendor Assessments 35
3 Security Architecture and Design 39
Principles of Secure Design 39
Security Operations Foundations 42
Ensuring Confidentiality, Integrity, and Availability 44
Understanding Security Models 46
Implementing Personnel Security 49
Applying Protection Mechanisms 52
System Resilience and High Availability 54
4 Identity and Access Management 57
IAM Core Concepts and Principles 57
Authentication Methods and Multifactor Authentication 60
Role-Based Access Control Versus Attribute-Based Access Control 62
Identity Federation and Single Sign-On 65
Zero Trust Architecture for IAM 68
Identity Governance Life Cycle 71
Access Control Attacks 73
5 Data Protection and Privacy Engineering 77
Data Classification and Labeling 77
Data Masking, Tokenization, and Encryption 80
Data Loss Prevention Strategies 82
Privacy by Design 85
Developing a Privacy Program 87
Cross-Border Data Transfers and Legal Implications 90
Data Subject Rights and Privacy Request Handling 93
Data Retention, Archiving, and Secure Disposal 96
6 Security and Privacy Incident Management 101
Incident Response Planning 101
Detection and Triage of Security and Privacy Incidents 104
Investigating Incidents 106
Communication Plans for Incident Response 110
Post-Incident Review and Lessons Learned 113
Privacy Breach Notifications and Regulatory Reporting 117
7 Network Security and Privacy Protections 121
Secure Network Components 121
Network Segmentation 125
System Hardening 128
Firewalls and Intrusion Detection/Prevention Systems 130
Virtual Private Networks and Secure Access Service Edge 133
Secure Wireless Network Management 136
Securing the Cloud 139
Network Monitoring 142
8 Security Assessment and Testing 145
Building a Security Assessment and Testing Program 145
Vulnerability Management 147
Understanding Security Vulnerabilities 150
Penetration Testing 153
Testing Software 155
Training and Exercises 158
9 Endpoint and Device Security 163
Endpoint Detection and Response 163
Network Device Security 166
Mobile Device Management 169
Understanding Malware 173
Malware Prevention 176
Patching and Vulnerability Remediation 178
10 Application Security 183
Secure Software Development Life Cycle 183
DevSecOps and DevOps Integration 187
Application Attacks 191
Injection Vulnerabilities 192
Authorization Vulnerabilities 194
Web Application Attacks 196
Application Security Controls 198
Coding Best Practices 201
11 Cryptography Essentials 205
Core Cryptography Concepts 205
Symmetric Cryptography 208
Asymmetric Cryptography 210
Hash Functions 213
Digital Signatures 216
Public Key Infrastructure 218
Key Management Best Practices 220
Cryptographic Attacks 222
12 Physical and Environmental Security 227
Security and Facility Design 227
Physical Access Controls and Monitoring 229
Security in Data Centers and Server Rooms 232
Environmental Controls 234
Implement and Manage Physical Security 235
13 Legal and Ethical Considerations 237
Computer Crime 238
Intellectual Property Laws 241
Software Licensing Laws 243
Import/Export Laws 244
Privacy Laws 246
Compliance 249
Ethical Considerations 250
14 Threat Intelligence and Cyber Defense 253
Threat Actors 253
Threat Vectors 256
Threat Intelligence 258
Threat Feeds 259
Threat Hunting 262
Assessing Threat Intelligence 263
Cyber Kill Chain and the MITRE ATT&CK 265
15 Business Continuity and Disaster Recovery 269
Project Scope and Planning 270
Conducting Business Impact Analysis 273
Business Continuity Planning Essentials 277
Recovery Planning Essentials 279
Disaster Recovery Strategies and Solutions 282
Testing and Simulation Exercises 284
Index 289
CHAPTER 1
Security and Privacy Foundations
In the ever-evolving landscape of information security and privacy, it is crucial for professionals to have a solid foundation in both domains. This chapter is designed to equip you with essential knowledge and insights that are fundamental to safeguarding information and ensuring privacy in your organization. As security and privacy threats become more sophisticated, understanding the core principles and frameworks that underpin these fields will enable you to develop robust strategies and implement effective controls.
By exploring the foundational concepts of security and privacy, you will gain a comprehensive understanding of key principles such as confidentiality, integrity, availability, authentication, authorization, and accounting. Additionally, you will delve into the intricacies of privacy in the modern era and the foundational principles that guide privacy practices. This chapter also covers critical frameworks and policies that provide structure and guidance for security and privacy initiatives. By the end of this chapter, you will be well-versed in the foundations of creating and enforcing policies, establishing security awareness programs, and developing strategic approaches to security and privacy management. This knowledge is vital for protecting your organization's assets and ensuring compliance with regulatory requirements.
Security 101
We often hear how important security is, but we don't always understand why. Security is essential because it helps to ensure that an organization can continue to exist and operate despite any attempts to steal its data or compromise its physical or logical elements. Security is an element of business management rather than only an information technology (IT) or information systems (IS) concern. Furthermore, IT/IS and security are different. IT/IS comprises the hardware and software that support the operations or functions of a business. Security is the business management tool that ensures the reliable and protected operation of IT/IS. Security exists to support the organization's objectives, mission, and goals.
Generally, a security framework that provides a starting point for implementing security should be adopted. Once security is initiated, fine-tuning that security is accomplished through continuous evaluation and stress testing. There are three common types of security evaluation:
- Risk assessment is identifying assets, threats, and vulnerabilities to calculate risk. Once risk is understood, it is used to guide the improvement of the existing security infrastructure.
- Vulnerability assessment uses automated tools to locate known security weaknesses, which can be addressed by adding more defenses or adjusting the current protections.
- Penetration testing uses trusted teams to stress test the security infrastructure to find issues that may not be discovered by the prior two means and to find those concerns before an adversary takes advantage of them.
Security should be cost-effective. Organizations do not have infinite budgets and, thus, must allocate their funds appropriately. Additionally, an organizational budget includes a percentage of monies dedicated to security, just as most other business tasks and processes require capital, not to mention payments to employees, insurance, retirement, and so on. You should select security controls that provide the most significant protection for the lowest resource cost.
Security should be legally defensible. The laws of your jurisdiction are the backstop of organizational security. When someone intrudes into your environment and breaches security, especially when such activities are illegal, prosecution in court may be the only available response for compensation or closure. Also, many decisions made by an organization will have legal liability issues. If required to defend a security action in the courtroom, legally supported security will go a long way toward protecting your organization from facing significant fines, penalties, or charges of negligence.
Security is a journey, not a finish line. It is not a process that will ever be concluded. It is impossible to fully secure something because security issues are always changing. Our deployed technology is changing with the passage of time, by users' activities, and by adversaries discovering flaws and developing exploits. The defenses that were sufficient yesterday may not be sufficient tomorrow. As new vulnerabilities are discovered, new means of attack are crafted, and new exploits are built, we have to respond by reassessing our security infrastructure and responding appropriately.
Confidentiality, Integrity, and Availability (CIA)
The CIA triad is a fundamental concept in information security, representing the three core principles that guide the protection of data and systems. This section provides an overview of these principles-confidentiality, integrity, and availability-and their importance in maintaining a secure information environment.
Confidentiality
Confidentiality is the concept of ensuring the protection of the secrecy of data, objects, or resources. The goal is to prevent or minimize unauthorized access to data. Confidentiality is maintained through various countermeasures such as encryption, strict access control, rigorous authentication procedures, data classification, and extensive personnel training. Violations of confidentiality can occur through intentional attacks, human error, oversight, or misconfigured security controls. Key concepts related to confidentiality include:
- Sensitivity: Determining whether information could cause harm if disclosed.
- Discretion: Controlling disclosure to minimize harm.
- Criticality: Measuring how vital to the company's mission the information is.
- Concealment: Hiding or preventing disclosure of information.
- Secrecy: Keeping information secret.
- Privacy: Keeping personally identifiable information confidential.
- Seclusion: Storing information in a secure location.
- Isolation: Keeping information separated from others.
Integrity
Integrity is the concept of protecting the reliability and correctness of data. It ensures that data is not altered in an unauthorized manner. Integrity protection allows for authorized changes while preventing unauthorized modifications, whether they are intentional, malicious, or accidental. Key aspects include:
- Data integrity: Ensuring that data remains accurate and consistent over its life cycle.
- System integrity: Ensuring that a system performs its intended function in an unimpaired manner.
- Process integrity: Ensuring that processes operate correctly without unauthorized modification.
Availability
Availability is the principle that ensures authorized users have timely and uninterrupted access to data and resources. It is crucial for maintaining the functionality of systems and services. Availability can be impacted by hardware failures, software issues, or malicious attacks such as denial of service (DoS). Measures to ensure availability include:
- Redundancy: Having backup systems in place.
- Failover: Switching automatically to a standby system.
- Load balancing: Distributing workloads across multiple systems.
- Maintenance: Updating and patching regularly to prevent system failures.
Disclosure, Alteration, and Destruction (DAD)
The DAD triad is a fundamental concept in information security that represents the failures of security protections in the CIA triad. Understanding the DAD triad is essential for identifying and mitigating the risks associated with security breaches. The DAD triad consists of three key elements: disclosure, alteration, and destruction.
- Disclosure: Occurs when sensitive or confidential material is accessed by unauthorized entities. This is a direct violation of confidentiality. Disclosure can happen through various means, such as data breaches, unauthorized access, or accidental exposure due to misconfigurations. Attackers who gain access to sensitive information and remove it from the organization are performing data exfiltration. Additionally, disclosure can occur accidentally, such as when an administrator misconfigures access controls or an employee loses a device.
- Alteration: Refers to the unauthorized modification of information, which violates the principle of integrity. This can happen through malicious activities like injecting fraudulent transactions into financial records or through accidental means such as typographical errors or system malfunctions. Attackers may seek to alter data for financial gain, reputational damage, or other malicious purposes. Natural activities, such as power surges causing bit flips, can also lead to unintended alterations.
- Destruction: Involves the damage or inaccessibility of resources, which violates the principle of availability. This can be the result of intentional actions like distributed denial-of-service (DDoS) attacks or unintentional events such as hardware failures or natural disasters. Destruction can significantly impact an organization's operations by making critical data or services unavailable to authorized users.
The DAD triad is a useful tool for cybersecurity planning and...
