This will be a broad overview of cybersecurity as provided by the study material.
How do we define 'Information Security'? Information Security is the safe guarding of data and computing resources from unauthorized access and destruction.
Generally, vulnerabilities can emerge from data-storage methods, transmission, and internal processing.
Systems that store, transfer, and process sensitive information must demonstrate the basics of security, which follow:
Confidentiality: Access to the system is limited by authorization procedures.
Integrity: Storage and transfer of information is reliable, and making changes requires authorization.
Availability: The system is readily accessible to those with authorization.
Non-repudiation: Tracking and documentation of system activities such that authorized actors cannot deny suspicious or malicious behavior.
How do we define the broad activity of Cybersecurity?: Cybersecurity is the act of provisioning secure IT processes, and secure hardware and software resources.
Information Security and Cybersecurity activities fall into five categories as described by NIST: NIST CyberSec Framework Documentation
Identify: Establish policies and capabilities to evaluate risks, threats, and vulnerabilities, and recommend additional policies and changes to mitigate these items.
Protect: Procure, develop, install, operate, and decommission hardware and software assets with security as an intrinsic requirement in each phase of the operation lifecycle.
Detect: Monitor systems to ensure security controls are effective against new and existing threats.
Respond: Identify, analyze, contain, and eliminate threats.
Recover: Implement resilience, restore systems and data in the event of an attack or other failure resulting in loss.
Identification leads into Protection: Building policies and evaluating possible threats and vulnerabilities informs handling and procurement of resources, with intent to effectively protect the organization and its resources.
Detection provides Feedback: As threats emerge they demand policies, protocol, and arsenal-of-action (which Identify threats) change to effectively protect against new threats. Detection is also an outwardly directed activity, and it must include regular research in addition to simply monitoring systems for new threats. Security personnel should be well-informed about emerging exploits and attacks in the cybersecurity literature, especially those relevant to the platforms they operate.
Response provides Feedback: As Response mitigates attacks and demands Protection activities, it informs additional changes to Identification protocols and Responsive action.
Recovery activities directly inform Protection. Both categories are somewhat intertwined, as regular and robust backups are essential too protect data from catastrophic loss. In the event of data loss, this protection activity allows data and systems to be restored from copies and system images.
Each of the previously outlined security functions is also associated with a list of goals and outcomes. Outcomes are achieved by implementing Security Controls.
A Cybersecurity Framework guides the selection and setup of controls.
A Framework is necessary to prevent organizations from building a security program in isolation, which may fail to account for basic security concerns.
Frameworks also inform objective statements on an organization's Cybersecurity capabilities and establish the priority of improvements.
Finally, Frameworks provide structure and planning to risk management teams, as well as externally verifiable statements of compliance.
What is Gap Analysis?: Gap Analysis identifies deviations from standards set by a chosen Framework, in the systems of an organization. This is done on adoption of a Framework, and is often repeated to meet additional compliance requirements.
For each section of a Framework, Gap Analysis provides overall and detailed scores with recommendations for improvement.
While Gap Analysis CAN be conducted internally, it is often done by a third party. This ensures the integrity of the analysis, eliminates internal biases, and can reveal blind spots or oversights of the internal teams.
Access Controls govern access to networks, servers, databases, software, and files using a system of rights and permissions.
Access Controls use the Identity and Access Management Protocol, which includes four processes:
Identify: Accounts or IDs represent users, devices, or processes.
Authenticate: Proof of identity, usually provided by a secret password, token, or certificate.
Authorize: Specific rights of access and enforcement of those rights or their absence.
Accounting: Recording use of a resource or rights, and producing alerts when unauthorized access is detected or attempted.
Note: Servers and Protocols that implement this can be called Authentication, Authorization, and Accounting (AAA). Servers and processes also need to authenticate to make automated use of resources or establish external internet connections.
Up Next: Security Controls