Please enable JavaScript.

Coggle requires JavaScript to display documents.

Domain 5: Security Operations - Coggle Diagram

- - - - Typical Sensitivity Levels:
        
        **Highly restricted**: Compromise of data with this sensitivity label could possibly put the organization’s future existence at risk. Compromise could lead to substantial loss of life, injury, or property damage, and litigation and claims would follow.
        -
        
        **Moderately restricted**: Compromise of data with this sensitivity label could lead to loss of temporary competitive advantage, loss of revenue or disruption of planned investments or activities.
        -
        
        **Low sensitivity (sometimes called “internal use only”)**: Compromise of data with this sensitivity label could cause minor disruptions, delays, or impacts.
        -
        
        **Unrestricted public data**: As this data is already published, no harm can come from further dissemination or disclosure.
    - - Policy Guarantees: Records retention policies indicate how long an organization is required to maintain information and assets. Policies should guarantee that:
        
        Personnel understand the various retention requirements for data of different types throughout the organization.
        -
        
        The organization appropriately documents the retention requirements for each type of information.
        -
        
        The systems, processes, and individuals of the organization retain information in accordance with the required schedule but no longer.
        -
        
        Common Mistake: A common mistake in records retention is applying the longest retention period to all types of information in an organization. This not only wastes storage but also increases the risk of data exposure and adds unnecessary “noise” when searching or processing information in search of relevant records
        -
        
        Destruction of Unneeded Records: Records and information no longer mandated to be retained should be destroyed in accordance with the policies of the enterprise and any appropriate legal requirements that may need to be considered.
    - - Methods of Destruction: This can be done by one of several means:
        
        **Clearing**: Usually involves** writing multiple patterns of random values throughout all storage media such as main memory, registers, and fixed disk**s. This is sometimes called “overwriting” or “zeroizing” the system, although writing zeros has the risk that a missed block or storage extent may still contain recoverable, sensitive information after the process is completed.
        -
        
        **Purging**: Eliminates, or greatly reduces, the chance that residual physical effects from the writing of the original data values may still be recovered, even after the system is cleared. Some magnetic disk storage technologies, for example, can still have residual “ghosts” of data on their surfaces even after being overwritten multiple times. **Magnetic media, for example, can often be altered sufficiently to meet security requirements; in more stringent cases, degaussing may not be sufficient.**
        -
        
        **Physical destruction**: Is the ultimate remedy to data remanence.** Magnetic or optical disks and some flash drive technologies** may require being mechanically shredded, chopped or broken up, etched in acid or burned; their remains may be buried in protected landfills, in some cases.
  - - - It can be hard to ensure that the device is configured securely and does not have any backdoors or other vulnerabilities that could be used to access organizational data or systems.
        -
        
        All employees must read and agree to adhere to this policy before any access to the systems, network, or data is allowed.
        -
        
        If and when the workforce grows, so too will the problems with BYOD. Certainly, the appropriate tools will be necessary to manage the use of and security around BYOD devices.
        -
        
        The organization needs to establish clear user expectations and set the appropriate business rules.
    - - The organization’s privacy policy should stipulate which information is considered PII/ePHI, the appropriate handling procedures and mechanisms used by the organization, how the user is expected to perform in accordance with the stated policy and procedures, any enforcement mechanisms and punitive measures for failure to comply, as well as references to applicable regulations and legislation to which the organization is subject.
        
        This can include national and international laws, such as the GDPR in the EU and Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada;
        -
        
        Laws for specific industries in certain countries such as HIPAA and Gramm–Leach–Bliley Act (GLBA) in the United States; or local laws in which the organization operates.
        -
        
        The organization should also create a public document that explains how private information is used, both internally and externally.
        
        For example, it may be required that a medical provider present patients with a description of how the provider will protect their information, or a reference to where they can find this description, such as the provider’s website.
    - - Throughout the system life cycle, changes made to the system, its individual components, and its operating environment all have the capability to introduce new vulnerabilities and thus undermine the security of the enterprise.
        -
        
        Change management requires a process to implement the necessary changes so they do not adversely affect business operations.
- - - - Encryption system is to transform an original set of data, called the plaintext, into an otherwise unintelligible encrypted form, called the ciphertext.
      - An encryption system is a set of hardware, software, algorithms, control parameters, and operational methods
    - - Confidentiality
        
        Cryptography provides confidentiality by hiding or obscuring a message so that it cannot be understood by anyone except the intended recipient
        -
        
        Confidentiality keeps information secret from those who are not authorized to have it.
      - Integrity
        
        Hash functions and digital signatures can provide integrity services that allow a recipient to verify that a message has not been altered by malice or error.
        -
        
        These include simple message integrity controls. Any changes made by the sender or the recipient, either deliberate or accidental,
- - - - Education may help workers in a secure
        server room understand the interaction
        of the various fire and smoke detectors,
        suppression systems, alarms, and their
        interactions with electrical power, lighting
        and ventilation systems.
    - - Training would provide those workers with
        task-specific, detailed learning about the
        proper actions each should take in the
        event of an alarm, a suppression system
        going off without an alarm, a ventilation
        system failure or other contingency
    - - Awareness activities would include not
        only posting the appropriate signage,
        floor, or doorway markings, but also
        other indicators to help workers detect
        an anomaly, respond to an alarm and take
        appropriate action.
  - - - Devices and tools include:
        
        Firewalls: Block or allow traffic based on security rules.
        -
        
        Gateways: Entry/exit points of the network where traffic is controlled.
        -
        
        Remote authentication servers: Verify the identity of users attempting remote access.
        -
        
        IDS/IPS tools (Intrusion Detection System / Intrusion Prevention System):
        IDS: Detects intrusions (alerts only).
        IPS: Prevents intrusions (alerts and blocks).
        -
        
        SIEM solutions (Security Information and Event Management): Collect and analyze logs from various sources to detect security events.
        -
        
        Anti-malware solutions: Detect and remove malicious software.
    - - The DLP solution should be deployed so that it can inspect all forms of data leaving the organization, including
        
        Email (content and attachments): Prevents sensitive information from being sent via email.
        -
        
        Copy to portable media: Prevents data from being copied to USB drives, external hard drives, etc.
        -
        
        File Transfer Protocol (FTP): Controls data uploaded/downloaded via FTP.
        -
        
        Posting to web pages/websites: Prevents sensitive data from being uploaded to unauthorized websites.
        -
        
        Applications/application programming interfaces (APIs): Monitors data shared through applications and APIs.