INF4831 - Cyber Security

Exam note¶

Chapter 1 - Overview¶

In this chapter you will learn about the concept of information security and that it has five properties, namely:

• availability

• integrity

• confidentiality

• authentication

• nonrepudiation

vulnerability, threat, availability, integrity, confidentiality, authentication, nonrepudiation and authorization

You need to first understand these properties before you move on to the next chapters.

Also, make sure that you understand the concept of a vulnerability and threat. These two concepts are different and controls need to be implemented to protect assets from both.

You must also know that threats are caused by both human and other sources. Look at fig 1-8 for an overview of typical vulnerabilities. The objective of information security is to protect the organisation's assets from these vulnerabilities and threats.

From a human perspective there are various types of attackers.

Organisations use risk management to help them to identify threats that could exploit vulnerabilities in assets and to calculate the risk (impact * probability) in order to identify how to protect the assets. In some instances controls are implemented in other cases the risks are transferred or even accepted.

Organisations make use of a variety of controls like physical controls, procedural, technical and human related controls (e.g. awareness and training). A combination of controls should be implemented. There are also 6 ways to deal with harm namely:

1. Deter

2. Deflect

3. Mitigate

4. Detect

5. Recover

6. Prevention

Harm is categorised by four acts namely: interception, interruption, modification and fabrication. You should be able to understand these concepts and how to apply it. 

Also be aware that there is a concept like method-opportunity-motive in which these are all necessary for an attack to succeed. Deny any of the below then the attack will fail.
Method - The skills, knowledge, tools and other things which are needed to perpetrate the attack.
Opportunity - Time and access, to execute the attack.
Motive - Reason to want to attack, some attacks are personal or political etc.

Make sure that you can give definitions of the terminology in chapter 1 and that you understand all the concepts.

Chapter 2 - Authentication, access control, cryptography¶

1.     Describe substitution and transposition ciphers.

2.     Describe symmetric and asymmetric cryptography.

3.     Identify current cryptographic algorithms and discuss their function, application, strengths and weaknesses.

4.     Describe and discuss the uses of cryptography.

5.     Apply cryptographic methods to encrypt and decrypt messages and digitally sign data.

Work through this chapter and make sure that you understand:

• The basics of authentication

• Strength of an authentication mechanism

• Implementation of access control

• Employing of encryption

• Symmetric and asymmetric encryption and the difference between it

• Message digests

• Signatures and certificates: Know the primary conditions of a digital signature (unforgeable and authentic) and the properties (not alterable and not reusable).

In this chapter you need to ensure that you understand the concepts of identification and authentication.

Identification asserts your identity (your online name, bank account number).

Authentication confirms that you are who you say you are - this must be private and secure using for instance a password, PIN, biometric or access card.

There are various attacks on passwords - every password can be guessed - the strength is determined by how many guesses are required.

Attackers use different techniques to guess a password like a) dictionary attack b) inferring a password c) guessing probable passwords d) defeating concealment e) exhaustive attacks. Know the difference of these techniques.

There are different authentication methods which you should know for example a) active token b) passive token c) static token d) dynamic token e) single sign-on f) mutlifactor authentication

Biometrics (e.g. fingerprint or voice) can also be used for authentication, but has problems like being relatively new, costly and a single point of failure. Also know the problems of biometrics.

A first control is a password, but passwords must be set up according to good characteristics like:

• Use characters other than just a-z
• Choose long passwords
• Avoid actual names or words
• Use a string you can remember
• Use variants for multiple passwords
• Change the password regularly
• Do not write it down
• Don’t tell anyone else (social engineering: attacker contacts administrator to elicit the password, or send an email which looks authentic with a link on which directs user to a malicious website.

There must be an effective policy for access control and three goals must always be achieved namely:
1. Check every access
2. Enforce least privilege
3. Verify acceptable usage

You should know the access control directory and access control matrix. 

Encryption

The system for encryption and decryption is called a cryptosystem.
Encryption and decryption rules are called algorithms and often uses a key. It uses two basic techniques, namely replacing and shuffling.
If the encryption and decryption key are similar it is called symmetric or single key or secret key encryption. 
If the encryption and decryption keys work in pairs (one key encrypts and another decrypts) it is called asymmetric encryption.
Stream encryption can be used where each bit/byte is encrypted separately, which is expensive.
Block encryption encrypts a group of plaintext symbols as a single block .
Stream encryption advantage: speed of transformation and low error propagation; disadvantage = low diffusion and susceptibility to malicious insertions.
Block encryption advantage: high diffusion and immunity to insertion of a symbol; disadvantage = slowness of encryption, padding and error propagation. 

Below a short summary of the encryption standards:
• DES ENCRYPTION: Repeating of substitution and trans positioning in 16 iterations. One 56-bit key.
• DOUBLE DES: Uses two keys, one encryption on top of the other, two 56-bit keys.
• TWO-KEY DES: Uses two keys, encrypt with first, result with second and results with first, two 56-bit keys.
• TRIPLE DES: Uses three keys which significantly enhance the security, three 56-bit keys. 
• AES: Uses substitution, shit, bit mixing, 128/192/256 bit key lengths. Improver over DES 
• RSA: Public key system, thus public and private key are used. 256 minimum key length up to 2000 bits. Using exponentiation, raising each plaintext block to a power. Slower than DES and AES. 

MD4, MD5, SHA (SHS) are the mostly used cryptographic hash functions. AES is a stronger encryption than DES.

You should also be able to apply the Caesar Chiper and column permutation cipher on a message to derive the cipher text. Look in the "Additional Resources" section for guidance on how to do this.

Validating a program

There are 3 ways to validate a program namely requirements checking, design and code reviews as well as system testing. Make sure you know these concepts.

Viruses and terminology

This chapter also addresses viruses. You should know what a virus signature, code analysis and storage patterns are. 

Also know the following terminology a) race condition b) backdoor c) static code analyser d) stack e) salt f) rainbow table

Also, participate in the discussion form and answer the questions there.

Chapter 3 - Secure programs¶

Specific outcome 3

Demonstrate an understanding of program security and the design and protection of general-purpose operating systems.

(Refer to chapters 3 and 5.)

Assessment criteria

1.     Describe secure programs.

2.     Discuss programming errors and complexity leading to vulnerabilities in computer systems.

3.     Demonstrate an understanding of the various types of malicious software, their effect, and how to defend against them.

4.     Understand and apply controls against program threats.

5.     Discuss operating system security methods.

6.     Demonstrate an understanding of memory and address protection in operating systems.

7.     Demonstrate an understanding of file protection mechanisms, access control and authentication in operating systems.

8.     Discuss security policies as they relate to operating systems.

9.     Discuss and evaluate the models of security as they apply to operating systems.

10. Demonstrate an understanding of the methods of designing a secure operating system.

Chapter 3 outlines vulnerabilities in computer programs.

Know the different programming oversights:

• Buffer overflows: This is a programming error. For example when you define an array of 1 to 10 characters an error will occur if a number of more than 10 characters is calculated. It is used by attackers to first cause a system crash and then a controlled failure with a serious security implication. Also know the countermeasures such as staying within bounds and double checking the boundary condition.

• Incomplete mediation: Mediation means checking  - process of intervening to confirm an actor’s authorisation before it takes an intended action. Thus verifying that an actor is authorised to perform the operation on an object. Incomplete mediation is a security problem e.g. data is validated and incorrect input is captured by users resulting in errors

• Time-of-check to time-of-use errors: This is a security flaw that relates to mediation. Data is changed between the access check and the use. Also explained by terms of time lag.

- Undocumented access point: Programmer creates an undocumented entry point or execution mode while developing a program, but forgets to remove it when programs goes into development. It can also be left to program maintenance - creating a hole/backdoor.

Also know off-by-one-errors.

Testing of program components

It is important to test program component therefore know the following testing a) module testing, b) component testing, c) integration  testing, d) function testing, e) performance testing, f) acceptance testing and g) installation testing h) regression testing i) black-box testing and j) clear-box testing.

A system can also be validated using requirements checking, design and code reviews and system testing.

Viruses

You should understand the threats posed by malicious code and how to protect against it.

Know the difference between a virus, worm and Trojan horse:

Virus: A program that can replicate itself and pass on malicious code to other non-malicious programs by modifying them. It spreads through any medium. 

Worm: A program that spreads copies of itself through a network. It spreads through a network 

Trojan horse: Malicious code that, in addition to its primary effect, has a second, non-obvious, malicious effect. 

Also understand how viruses are transmitted for example the setup and installer program transmission, attached files, autorun, appended viruses, viruses that surround a program or integrated viruses.

Know the following terms: 

1. Rabbit
2. Logic bomb
3. Time bomb
4. Dropper
5. Hostile mobile code agent
6. Script attack
7. RAT
8. Spyware
9. Bot
10. Zombie
11. Browser hijacker
12. Rootkit
13. Trapdoor/backdoor
14. Toolkit
15. Scareware
16. Race condition
17. Static code analyzer
18. Stack

You must know what software engineering techniques developers can use to improve the security of code against malware infection (understand what each word means):

1. Modularity
2. Encapsulation
3. Information hiding
4. Mutual suspicion
5. Confinement
6. Simplicity
7. Genetic diversity

Remember to participate in the online forum discussions for chapter 3.

Chapter 4 - Web (User side)¶

Specific outcome 5

Demonstrate an understanding of security in networks.

(Refer to chapters 4, 6 and 8.)

Assessment criteria

1.     Discuss network threats.

2.     Identify and describe the various network security controls, methods and techniques.

3.     Identify and describe the various network security tools.

4.     Apply the appropriate techniques or tools in design to secure a network.

Chapter 4 focuses on the web in the context of the user side. Remember that browsers expose users to significantly greater security threats than most other kinds of software and also has many vulnerabilities for attack.

The major browsers are:

Google Chrome, Mozilla Firefox, Microsoft Internet Explorer, Opera and Safari.

Examples of attacks against browsers:

• Man-in-the-browser: For example SilentBanker. Remember that browser attack succeed because of failed identification and authentication. SSL and HTTPS cannot mitigate the risk of a man-in-the-browser attack. The man-in-the-browser attacker intercepts the data before it can be encrypted. 

• Keystroke logger: Hardware or software that records keystrokes.

• Page-in-the-middle: Redirects the use to the attacker's page.

• User-in-the-middle: Refer to the CAPTCHA example in the textbook. This attack can be defeated by the concept of a shared secret.

Countermeasures against authentication vulnerabilities are: shared secret, one-time password and an out-of-band-communications.

Also know what a program download substitution is: The attacker presents a page with a desirable and seemingly innocuous program for the user to download, for example a browser toolbar or photo organiser. Instead (or in addition) of downloading the toolbar the attacker downloads and installs malicious code. Unfortunately the user intentionally accepts the download. 

You should also know the following terms/concepts:

a) Website defacement

b) Fake website 

c) Fake code 

d) Integrity checksum

e) Signed code

f) Web bug

g) Clickjacking

h) PGP

i) S/MIME

J) CAPTCHA

k) Drive-by download

l) Cross-site scripting

m) SQL injection

n) Spam

Integrity checksums and signed code are used as controls to protect websites against change.

Remember to participate in the discussion forums where questions about the chapter is posted. You can answer the questions and learn from the responses of the other students.

Chapter 5 - Operating systems¶

Specific outcome 3

Demonstrate an understanding of program security and the design and protection of general-purpose operating systems.

(Refer to chapters 3 and 5.)

Assessment criteria

1.     Describe secure programs.

2.     Discuss programming errors and complexity leading to vulnerabilities in computer systems.

3.     Demonstrate an understanding of the various types of malicious software, their effect, and how to defend against them.

4.     Understand and apply controls against program threats.

5.     Discuss operating system security methods.

6.     Demonstrate an understanding of memory and address protection in operating systems.

7.     Demonstrate an understanding of file protection mechanisms, access control and authentication in operating systems.

8.     Discuss security policies as they relate to operating systems.

9.     Discuss and evaluate the models of security as they apply to operating systems.

10. Demonstrate an understanding of the methods of designing a secure operating system.

Chapter 5 concentrates on operating systems. The operating system is the first line of defense against all sorts of unwanted behaviour. It protects one user from another, ensures that critical areas of memory or storage are not overwritten by unauthorised processes, performs identification and authentication of people and remote operations, and ensures fair sharing of critical hardware resources.

Several aspects of a computing system require protection and can be seen in layers:

• Memory

• Shareable I/O devices, such as disks

• Serially reusable I/O devices, such as printers and tape devices

• Sharable programs and sub procedures

• Sharable data

The basis of protection is separation. This can be achieved in an operating system through:

1. Physical separation
2. Temporal separation
3. Logical separation
4. Cryptographic separation (know these terms)

Memory can be protected through:

1. Fence
2. Base/bound registers
3. Tagged architecture
4. Virtual memory
5. Segmentation
6. Paging

Know the following terms:

1. Virtualisation
2. Hypervisor
3. Trusted computing base (TCB) (Also know the four basic interaction of the TCB monitor and reasons why the security functions should be isolated in the security kernel)
4. Sandbox
5. Honeypot

Chapter 6 - Networks¶

Specific outcome 5

Demonstrate an understanding of security in networks.

(Refer to chapters 4, 6 and 8.)

Assessment criteria

1.     Discuss network threats.

2.     Identify and describe the various network security controls, methods and techniques.

3.     Identify and describe the various network security tools.

4.     Apply the appropriate techniques or tools in design to secure a network.

Chapter 6 concentrates on remote networks. In such a network the user has little if any expectation of control and hence the security risks are great. You will learn about threats to a network as well as the countermeasures. Make sure that you firstly understand the concepts of a network before you study the threats and countermeasures such as a protocol, packet, MAC address and network interface card.

Know the security concerns: sequencing, substitution, insertion and replay.

Network communications are performed through a virtual concept called Open System Interconnection (OSI) model.

Data layers

Application: Network process to applications

Presentation: Data representation and encryption

Session: Interhost communication

Segments

Transport: End-to-end connections and reliability

Packets

Network: Path determination and IP (Logical Addressing)

Frames

Data link: MAC and LLC (Physical Addressing)

Bits

Physical: Media, signal and binary transmission

A network is vulnerable to interception due to aspects like:

• Anonymity
• Many points of attack
• Sharing
• System complexity
• Unknown perimeter
• Unknown path

Know the following terms:

1. Onion routing
2. Ping of death
3. Smurf
4. Echo-chargen
5. SYN flood
6. Link encryption
7. End-to-end encryption
8. Browser encryption - SSH
9. Browser encryption - SSL
10. VPN
11. Firewall
12. Botmaster
13. Packet sniffing
14. Radiation
15. Cable splicing
16. Sink holing

Nessus, NMap and CyberCop Scanner are examples of port scanning tools. Port scanning is an inspection activity and does not cause harm.

A proxy can be used to implement security in a network by preventing client systems from communicating directly with an outside source, reducing exposure and risk, filter outgoing traffic requests and verifying legitimate traffic. As the middleman, proxies are capable of protecting clients from themselves.

For a system like Windows basic security requirements could apply such as installing anti-malware software, OS and application security updates as soon as they are available and only browsing safe websites.

Wireless networks

Know the management frames that control the establishment and handling of a series of data flows in a WiFi. The recommended security protocol is WPA. Also know the reasons why WPA is recommended.

Remember that in a network transmission optical fiber is regarded as more secure compared to microwave, satellite or wire

Firewalls

Make sure you read through the firewall section in the textbook.

Know the different firewalls in and which situation to apply it.

a) Packet Filtering Gateway

b) Stateful Inspection Firewall

c) Application Proxy

d) Circuit-Level Gateway

e) Guard

Remember to participate in the chapter 6 online discussions.

Chapter 7 - Databases¶

Specific outcome 4

Demonstrate an understanding of database security.

(Refer to chapter 7.)

Assessment criteria

1.     Demonstrate an understanding of security requirements of databases.

2.     Demonstrate an understanding of the concepts of reliability and integrity and discuss methods of ensuring them.

3.     Discuss the methods used to secure multilevel databases.

4.     Demonstrate an understanding of data mining.

Chapter 7 focuses on the security of databases and database management systems.

Remember that a database is a collection of data and set of rules that organise the data by specifying certain relationships among the data. Through these rules, the user specifies a logical format for the data. The data items are stored in a file, but the precise physical format of the files is of no concern to the user. The database administrator defines the rules that organise the data and also controls who should have access to what part of the data. 

Inference is when data values are used to derive other data that could be valuable. Examples are applying SUM, Count, Mean, Median and Tracker Attacks. Also called indirect attacks.

Know the requirements for database security:

• Physical database integrity: The data of a database are immune from physical problems, such as power failures, and someone can reconstruct the database if it is destroyed through a catastrophe.
• Logical database integrity: The structure of the database is preserved. With logical integrity of a database, a modification to the value of one field does not affect other fields, for example.
• Element integrity: The data contained in each element are accurate.
• Auditability: It is possible to track who or what has accessed (or modified) the elements in the database.
• Access control: A user is allowed to access only authorized data, and different users can be restricted to different modes of access (such as read or write).
• User authentication: Every user is positively identified, both for the audit trail and for permission to access certain data.
• Availability: Users can access the database in general and all the data for which they are authorized.

There are 5 methods that can be used to address inference and aggregation problems:

1. Suppress obviously sensitive information.
2. Track what the user knows.
3. Disguise the data.
4. Suppression – suppression blocks release sensitive data.
5. Concealing – releases data or an approximation of sensitive data.

Know the following terms:

1. Apache Hadoop
2. Big data
3. Data mining
4. Error detection and correlation codes
5. Shadow fields

Remember to participate in the chapter 7 online discussions.

Chapter 8 - Cloud computing¶

Specific outcome 5

Demonstrate an understanding of security in networks.

(Refer to chapters 4, 6 and 8.)

Assessment criteria

1.     Discuss network threats.

2.     Identify and describe the various network security controls, methods and techniques.

3.     Identify and describe the various network security tools.

4.     Apply the appropriate techniques or tools in design to secure a network.

Chapter 8 focuses on cloud computing. This is not a new concept, but is defined as a model "for enabling convenient, on-demand network access to a shared pool of configurable computing resources. " 

The cloud consists of:

• networks
• servers
• storage
• applications
• services that are connected with a cloud service provider.

There are benefits of moving to a cloud such as geographical diversity, platform diversity, infrastructure diversity, reduced cost, increased storage, flexibility, etc 

There are 5 characteristics of cloud computing:

• On demand self service
• Broad network access
• Resource pooling
• Rapid elasticity
• Measured service

There are three basic cloud service models:

• Software as a service (SaaS): Cloud provider gives the customer access to applications running in the cloud. The customer has no control over the infrastructure or even most of the application capabilities.
• Platform as a service (PaaS): The customer has his/her own applications, the cloud affords the languages and tools for creating it. The customer has no control over the infrastructure.
• Infrastructure as a service (IaaS): The cloud offers processing, storage, network and other computing resources that enable customers to run any kind of software. The customer can request operating systems, storage, some applications and some network components. 

There are three deployment models:

• Private cloud
• Community cloud
• Public cloud

Before moving to a cloud environment one must conduct a risk analysis. Know the 6 risk analysis steps.

Know the following terms:

• FIdM
• SAML
• OAuth

Remember that an industry-standard encryption algorithm is the minimum requirement to protect data confidentiality in a public cloud environment

One way in which a company can ensure data loss prevention when moving data to the cloud is to force users to go through the company network to access the cloud environment.

The following can be implemented to aid in securing IaaS:
1. Virtual networks 
2. Encryption of data-in-transit and data-at-rest
3. Using a deletion tool that ‘wipes’ your data

If a cloud service such as SaaS or PaaS is used, communication will take place over HTTP. To ensure secure transport of the data the provider could use:
1. a secure transport layer
2. SSH 
3. VPN

Remember to participate in the chapter 8 online discussions.

Chapter 9 - Privacy¶

Specific outcome 6

Demonstrate an understanding of privacy in computing.

(Refer to chapters 9 and 11.)

Assessment criteria

1.     Critically discuss privacy in the age of the internet.

2.     Identify and discuss the methods, principles, policies and tools used to ensure privacy.

3.     Discuss the effect of various online tools and methods on privacy.

4.     Critically discuss the impact of emerging technologies on privacy.

Chapter 9 deals with privacy. Privacy is a human right and is enshrined in our constitution. In this chapter only the aspects of privacy relating to computer security is discussed.

Privacy is the right to control who knows certain aspects about you, your communications, and your activities - controlled disclosure.
Information privacy has 3 aspects, namely:

1. controlled disclosure: the right to control who knows certain things about you.
2. sensitive data: data protection regulation defines what personal information is and sensitive personal information.
3. affected subject: affected parties: the individual, company or government whose data is processed, confidentiality is a way to protect your privacy

In POPIA, sensitive (special) personal information is for example religion, race, trade union membership, political persuasion, health or sexual life and criminal behaviour. What is though sensitive to one person might not be to another. Data that is personal are your identity, finances, legal, health, biometrics, location, etc. In POPIA the definition for a data subject includes individuals as well as a juristic person.

Examples of personal data according to POPIA are:
"means information relating to an identifiable, living,
natural person, and where it is applicable, an identifiable, existing juristic person,
including, but not limited to—
(a) information relating to the race, gender, sex, pregnancy, marital status,
national, ethnic or social origin, colour, sexual orientation, age, physical or
mental health, well-being, disability, religion, conscience, belief, culture,
language and birth of the person;
(b) information relating to the education or the medical, financial, criminal or
employment history of the person;
(c) any identifying number, symbol, e-mail address, physical address, telephone
number or other particular assignment to the person;
(d) the blood type or any other biometric information of the person;
(e) the personal opinions, views or preferences of the person;
correspondence sent by the person that is implicitly or explicitly of a private
or confidential nature or further correspondence that would reveal the contents
of the original correspondence;
(f) the views or opinions of another individual about the person; and
g) the name of the person if it appears with other personal information relating to
the person or if the disclosure of the name itself would reveal information
about the person;"

Know the following terms:

1. Anonymity / Anonymization
2. Multiple identities
3. Pseudonymity
4. RFID
5. Cookies
6. Adware
7. Privacy for correlation
8. Privacy for aggregation

In South Africa the Protection of Personal Information Act (PoPI) was promulgated in 2013. 

You can find a copy of the act at:

http://www.acts.co.za/protection-of-personal-information-act-2013/index.html

POPIA is effective as of 1 July 2020. This means organisations have 1 year to comply. There are 8 conditions. Condition 7 of POPIA deals with security. This is good news for organisations as now security is mandatory from a regulatory perspective especially where personal information is processed. Personal information must as such be protected and the 8 conditions of POPIA must be implemented. Below is a table to give you an idea of how each condition should be implemented from a practical perspective.

POPIA is aligned to the Fair Information Practice Principles which are:

1. Collection limitation – Information must be collected in a fair and lawful manner.
2. Data quality – Data must be relevant, accurate, complete, and up-to-date.
3. Purpose Specification – Data must only be kept for a specific purpose and destroyed if the purpose is no longer necessary.
4. Use limitation – Use of data outside specified purpose is only allowed by consent or lawful authority.
5. Security safeguards – Data must be protected from loss, corruption, destruction, or misuse.
6. Openness – Information about how the data is collected, stored and used should be available.
7. Individual participation – Data pertaining to a subject must be accessible and can be challenged by the subject.
8. Accountability – The entity storing and controlling the data must be designated and responsible for enacting the other principles outlined by the fair information practices

Chapter 10 - Management¶

Specific outcome 7

Apply and evaluate security policies and security models.

(Refer to chapter 10.)

Assessment criteria

1.     Demonstrate an understanding of the purpose, creation and application of a security policy.

2.     Demonstrate an understanding of the purpose, creation and application of a security model.

The concepts of managing security are introduced in chapter 10, such as a security plan and the contents thereof. The concepts of business continuity and incident management are included as well as risk analysis.

The difference between a business continuity plan and an incident response plan is:

A power surge variation of 10% is acceptable, more indicates an incident.

Implement controls to prevent incidents such as:

• In the event of a fire Halon can be used in computer room automated fire extinguishers.
• In the event of disposing electronic data one should use the process called degaussing. 
• Copper conductive cases helps protect emissions from the screen being detected and analysed from a distance.

The six requirements of a security plan is:

Policy – Indicating the goals of computer security effort and the willingness of the people involved to work to achieve those goals
Current state – Describing the status of security at the time of the plan
Requirements – Recommending ways to meet the security goals.
Recommended controls – Mapping controls to the vulnerabilities identified in the policy and requirements
Accountability – Documenting who is responsible for reach security activity
Timetable – Identifying when different security functions are to be done
Maintenance – Specifying a structure for periodically updating the security plan

Also know the six requirements of the TCSEC:

• Security policy
• Identification
• Marking
• Accountability
• Assurance
• Continuous protection

The steps in a risk analysis are:

• Identify assets
• Determine vulnerabilities
• Estimate likelihood and exploitation
• Compute expected annual loss
• Survey applicable controls and their costs
• Project annual savings of control (the controls will remove or reduce the vulnerability)

Know the three types of security policies:

The enterprise information security policy (EISP):

• The high-level information security policy
• Sets the strategic direction, scope and tone for all of an organisation’s security efforts.
• Also known as a security program policy, general security policy, IT security policy, high-level InfoSec policy, or InfoSec policy.

Issue-specific security policy (ISSP):

• Detailed, targeted guidance to instruct all members of the organisation in the use of resources, such as one of its processes or technologies, e.g. password policy, business continuity policy.

System-specific security policy (SysSP):

• Standards or procedures to be used when configuring or maintaining systems. SYSSPs can be separated into two general groups, managerial guidance and technical specifications, e.g Windows policy, Active Directory. 

Know the following terms:

• CSIRT
• CERT
• Revolving backups
• Selective backup
• Offsite backup
• Cloud backup

Security models or best practice can be used by organisations to set up the information security function, develop the information security policy and to conduct risk analysis. The most know best practice for information security is ISO27001/2022. 

Remember to participate in the chapter 10 online discussions.

Chapter 11-13¶

Specific outcome 6

Demonstrate an understanding of privacy in computing.

(Refer to chapters 9 and 11.)

Assessment criteria

1.     Critically discuss privacy in the age of the internet.

2.     Identify and discuss the methods, principles, policies and tools used to ensure privacy.

3.     Discuss the effect of various online tools and methods on privacy.

4.     Critically discuss the impact of emerging technologies on privacy.

Chapter 11

Understand the difference between law and ethics, see table 11-3, p 745

• Know the steps to acting ethically:
• Understand the situation
• Identify ethical principles involved

Choose an action that meets the ethical principles.

Know the following terms:

• Copyright
• Patent
• Fair use of material
• Trademark
• Forensic analysis

Chapter 12:

Know what makes a secure encryption algorithm

Chapter 13: 

Know that mobile devices can be infected with viruses.

Understand why companies are investing in cyber security

Understand what information a cookie can contain

Understand what the internet of things are

Know what is meant with security models e.g. ISO27001/2 for example.

See also¶