Please enable JavaScript.

Coggle requires JavaScript to display documents.

Mitagating Threats - Coggle Diagram

- - - - Chief Information Officer (CIO)
      - Chief Information Security Officer (CISO)
      - Secuity Operations (SecOps)
      - Manager
      - Chief Security Officer (CSO)
      - Security Manager
      - Network Security Engineer
    - - Constantly upgrade their skill
      - Attend training and workshops
      - Subscribe to real-time feeds regarding threats
      - Peruse security websites on a daily basis
      - Maintain familiarity with network security organizations
  - - - Global Information Assurance Certification (GIAC)
      - International Information System Security Certification Consortium (ISC)2
      - Information System Audit and Control Association (ISACA)
      - International Council of E-Commerce Consultants (EC-Council)
      - Certified Wireless Security Professional (CWSP)
      - Cisco
        
        300-710 SNCF - Network Security Firepower
        
        300-715 SISE - Implementing and Configuring Cisco Identity Services Engine
        
        300-720 SESA - Securing Email with Cisco Email Security Appliance
        
        300-725 SWSA - Securing the Web with Cisco Web Security Appliance
        
        300-730 SVPN - Implementing Secure Solutions with Virtual Private Networks
        
        300-735 SAUTO - Automating and Programming Cisco Security Solutions
  - - - Confidentiality is only authorized individuals can access information
      - Integrity is the protection of data from unauthorized alteration
      - Availability is authorized users have interrupted access to the network resources and data
- - - - Ensure that security policies are created, reviewed, and maintained
    - - Assigns responsibilities for information security tasks within an organization
    - - Addresses security responsibilities relating to employees
    - - Concerns the way that organizations create an inventory of and classifications scheme for information assets
    - - Describes the restriction of access rights to networks, systems, applications, functions and data
    - - Concerns data encryption and management of information to protect the CIA triad
    - - Describes the protection of physical computer facilities and equipment
    - - Describes management of technical security controls in systems and networks
    - - Concerns the security of data as it is communicated on networks
    - - Ensures that information security remains a central concern in an organization´s process
    - - Concern the specification of contractual agreements that protect an organization's info
    - - Describes how to anticipate and respond to information security breaches
    - - Describes the protection, maintenance, and recovery of business-critical processes and systems
    - - Describes the process of ensuring conformance with information security policies, standards, and regulations
  - - - Establish rules of conduct and responsibilities of employees and employers
      - Portect the rights of workers and the business interests of employers
      - Depending, establish rules regarding employee conduct, attendance, dress code, privacy, and others
    - - Created and maintained by human resources staff to identify employee salary, pay schedule, employee benefits, work schedule, vacations, and more
      - Often provided to new employees to review and sign
    - - Identify a set of security objetives for a company, define the rules of behavior for user and admins, and specify system requirements
      - Objectives, rules, and requirements collectively ensure the security of a network and the computer systems
      - A constantly evolving document based on changes in the threat landscape, vulneabilities, and business and employee requirements
      - Benefits
        
        Demostrates an organization's commitment to security
        
        Sets the rules for expected behavior
        
        Ensures consistency in system operations, software and hardware acquisition and use, and maintenance
        
        Defines the legal consequences of violations
        
        Gives security staff the backing of management
      - List of policies that may be included in a security policy
        
        Identification and authentication policy
        
        Specifies authorized persons that can have access to network resources and identity verification procedures
        
        Password policies
        
        Ensures passwords meet minimum requirements and are changed regularly
        
        Acceptable Use Policy (AUP)
        
        Identifies network applications and uses that are acceptable to the organization
        
        Remote access policy
        
        Identify how remote users can access a network and what is accessible via remote connectivity
        
        Network maintenance policy
        
        Specifies network device operating systems and end user application update procedures
        
        Incident handling procedures
        
        Describes how security incidents are handled
  - - - Specify the goals of the BYOD program
      - identify which employees can bring their own devices
      - identify which devices will be supported
      - Identify the level of access employees are granted when using personal devices
      - Describe the rights to access and activities permitted to security personnel on the device
      - Identify which regulations must be adhered to when using employee devices
      - Identify safeguards to put in place if a device is compromised
    - - Password protected access
        
        Use unique passwords for each device and account
      - Manually control wireless connectivity
        
        Turn off Wi-Fi and Bluetooth connectivity when not in use. Connect only to trusted networks
      - Keep updated
        
        Always keep the device OS and other software updated
      - Back up data
        
        Enable backup of the device in case it is lost or stolen
      - Enable "Find my device"
        
        Suscribe to a device locator service with remote wipe feature
      - Provide antivirus software
        
        Provide antivirus software for approved BYOD devices
      - Use Mobile Device Management (MDM) software
        
        MDM software enables IT teams to implement security settings and software configurations
- - - - Cloud-bases security operations platforms that enables organizations to integrate many security functionalities into a single platform
    - - Consists of a broad set of technologies that function as a team - providing interoperability with the security infraestructure, including third-party technologies.
- - - - Helps prevent hosts from getting infected and spreading malicious code
      - Symatec
      - McAfee
      - Trend Micro
    - - These have update automation options so that new virus definitions and new software updates can be downloaded automatically or on demand
      - These are installed on computers and servers to detect and eliminate viruses. They don't prevent viruses from entering the network.
    - - The files can be remomved from the incoming data stream before they can cause an incident
  - - - Contaniment phase involves limiting the spread of a worm infection to areas of the network that are already affected
      - Inoculation phase runs parallel to or subsequent to the containment phase. All uninfected systems are patched with the appropriate vendor patch
      - Quarantine phase involves tracking down and identifying infected machines within the contained areas and disconnecting, blocking, or removing them
      - Threatment phase involves actively disinfecting infected systems.
  - - - Dynamic Host Configuration Protocol (DHCP) snooping
      - IP Source Guard
      - Dynamic Address Resolution Protocol (DAI) Inspection
      - Access Control Lists (ACLs)
- - - - Control plane is responisble for routing data correctly. The traffic consists of device-generated packets required for the operation of the network itself.
        
        Securing control plane
        
        Routing protocol authentication prevents a router from accepting fraudulent routing updates
        
        Control Plane Policing (CoPP) is designed to allow users to control the flow of traffic that is handled by the router processor of a network device
        
        AutoSecure can lock down the management plane functions and the forwarding plane services and functions of a router
      - Management plane is responsible for managing network elements. The traffic is generated either by network devices or network management stations
        
        Securing Management plane
        
        Login and password policy restricts device accessibility. Limits the accessible ports and restricts the "who" and "how" methods of access
        
        Present legal notification and display legal notices
        
        Ensure the confidentiality of data. Protects locally stored data.
        
        Role-based access control (RBAC). Ensures access is only granted to authenticated users, groups, and services
        
        Authorize actions restricts the actions and views that are permitted by any particular user, group, or service.
        
        Enable management access reporting. Logs and accounts for all access.
      - Data plane (Forwarding plane) is responsible for forwarding data. The traffic normally consists of user-generated packets being forwarded between end devices.
        
        Securing the Data plane
        
        Implementing ACLs
        
        Blocking unwanted traffic or users
        
        Reducing the change of DoS attacks
        
        Mitigating spoofing attacks
        
        Providing bandwidth control
        
        Classifying traffic to protect the Management and Control planes
        
        Antispoofing mechanisms
        
        Layer 2 security features
        
        Port security
        
        DHCP snooping
        
        Dynamic ARP Inspection (DAI)
        
        IP Source Guard (IPSG)