SANS - SEC 301 and CCNA Learning Set
Save
Terms in this set (574)
Everyone can do Principle of Least Privilege
everything they need to
do and nothing more.
Bradley Manning -
WikiLeaks Target - HVAC
hack
The cornerstone of all CIA Triad
security: Everyting done in
security addresses one or
more of these three things
Confidentiality, Integrity,
availability
Confidentiality - Only
those who need to access
something can; ties into
principle of least privilege
Integrity - data is edited
correctly and by the right
people. Failure ex.: Delta
$5 tickets round trip
tickets to anywhere Delta
flies/attach on pricing
database
Availability - If you cannot
use it, why do you have it?
,Pharmaceuticals and Confidentiality
government, research
Financials maintained in Integrity
part by confidentiality
eCommerce Ex. Amazon Availability
make $133,000/per minute
thus denial of service is
critical business impact;
power company need to
keep lights on = availability
issue
Authentication, AAA
Authorization,
Accountability
Detailed steps to make Procedure
policy happen
Policy, Procedure and PPT
Training
Users must know what Training
policies and procedures
say to follow them.
Broad general statement Policy
of management's intent to
protect information
,A security professional Security by Thirds
needs to be:
1/3 technologist
1/3 manager
1/3 lawyer
-Tkhis is the perfect
summation of the career
field.
-Technology supports
security efforts
-Management decisions
(and budgets) drive
security
-Legal issues mandate
security requirements
, Senior Mgmt: Security Roles and Responsiblities
-Has legal responsibility to
protect the assets of the
org:
That give him the ultimate
responsibility for security
-Authority can be
delegated - responsibility
cannot be
Data owner - person or
office with primary
responsibility for data;
owners determine
classification, protective
measures and more
Data custodian - the
person/group that
implement the controls;
make the decisions of the
owner happens
Users - use data; are also
automatically data
custodians
safety of people Number 1 Goal of Security
Save
Terms in this set (574)
Everyone can do Principle of Least Privilege
everything they need to
do and nothing more.
Bradley Manning -
WikiLeaks Target - HVAC
hack
The cornerstone of all CIA Triad
security: Everyting done in
security addresses one or
more of these three things
Confidentiality, Integrity,
availability
Confidentiality - Only
those who need to access
something can; ties into
principle of least privilege
Integrity - data is edited
correctly and by the right
people. Failure ex.: Delta
$5 tickets round trip
tickets to anywhere Delta
flies/attach on pricing
database
Availability - If you cannot
use it, why do you have it?
,Pharmaceuticals and Confidentiality
government, research
Financials maintained in Integrity
part by confidentiality
eCommerce Ex. Amazon Availability
make $133,000/per minute
thus denial of service is
critical business impact;
power company need to
keep lights on = availability
issue
Authentication, AAA
Authorization,
Accountability
Detailed steps to make Procedure
policy happen
Policy, Procedure and PPT
Training
Users must know what Training
policies and procedures
say to follow them.
Broad general statement Policy
of management's intent to
protect information
,A security professional Security by Thirds
needs to be:
1/3 technologist
1/3 manager
1/3 lawyer
-Tkhis is the perfect
summation of the career
field.
-Technology supports
security efforts
-Management decisions
(and budgets) drive
security
-Legal issues mandate
security requirements
, Senior Mgmt: Security Roles and Responsiblities
-Has legal responsibility to
protect the assets of the
org:
That give him the ultimate
responsibility for security
-Authority can be
delegated - responsibility
cannot be
Data owner - person or
office with primary
responsibility for data;
owners determine
classification, protective
measures and more
Data custodian - the
person/group that
implement the controls;
make the decisions of the
owner happens
Users - use data; are also
automatically data
custodians
safety of people Number 1 Goal of Security
