Discussing Ethics and Security Concepts

0:00When it comes to certification bodies, those organizations that issue certifications, and specifically within the information security realm, the ISC Squared Certifications, it is very important that you understand their code of ethics, because you'll be held to them. So let's jump in and talk about these ethics. So ISC Squared has a code of ethics. Now one question is, well, why do we have these? Well, we have these code of ethics to provide an expectation for those certified individuals' professional behavior.

0:37So in order to hold and maintain an ISC Squared Certification, you have to abide by the code of ethics. So your professional behavior must reflect those ethics. So let's go ahead and talk about what these are. We're starting with the code of ethics preamble, okay? And here it is, right here. It says, "The safety and welfare of society and the common good, the duty to our principles, and to each other requires that we adhere, and be seen to adhere to the highest ethical standards of behavior."

1:13So if you are going to become ISC Squared certified, you have to follow these code of ethics. So you must adhere to the highest ethical standards of behavior. And down here, therefore, strict adherence to this code is a condition of certification. So if you're not gonna adhere to the code, you don't agree to it, you cannot be certified, according to ISC Squared. And this is one of their certifications. They have several of them out there. So next up is the code of ethics cannons.

1:45These are the four cannons of the code of ethics. Number one here. Protect society, the common good, necessary public trust and confidence, and the infrastructure. So you're looking to protect society. You're protecting the common good. You're protecting public trust and confidence, and of course the infrastructure as well. So it's by practicing these ethics that we gain trust. We become recognized professionals who follow these codes of ethics.

2:20Number two, you must act honorably, honestly, justly, responsibly and legally. So it's all of these things together. So not only do you have to protect these items over here, we have to act in certain ways. Then number three, we need to provide diligent and competence. That is key here. Diligent and competent services to principals, that's our customers. We have to maintain competency.

2:51And that is one of the reasons that we have to achieve certain CPE requirements, which are continuing professional education, to show that we are maintaining our competency. And then lastly, the fourth cannon here, we need to advance and protect the profession. So what we're meaning here is, by advancing the profession, we're keeping up with changes in the environments, and in security, and we are protecting the profession.

3:26We're protecting the profession by maintaining our ethical actions. And we're performing number one over here, of course two, and three. We're protecting the integrity of the profession, so that when someone sees that you hold an ISC Squared Certification, that they know that you do these things. You adhere to these four cannons, and you practice ethics. And that is key here, because when someone says, I hold X certification, if it's from an organization who just gives out pieces of paper and they don't really care about anything else except making money, then that certification just doesn't hold as much value.

4:07Whereas ISC Squared, they require that you adhere to this code of ethics. They require that you keep up to date with your CPE's, that you're studying, and you're advancing yourself and the profession, and that you're acting honorably, honestly, and justly and legally. And by adhering to that, it means that those certifications carry with them greater value. And that's where, as a professional within the security industry, we really need to adhere to these ethics.

4:42And now we're moving on to our organizational code of ethics. We've discussed our ISC Squared code of ethics, time to talk about the ethics for the organizations that we're a part of. And the organizational code of ethics does something for us. It helps to define the organization's ethical guidelines and best practices for a couple of things. Number one is honesty. Number two is integrity. Number three is professionalism. And that's what our organizational code of ethics do for us. They help us to define ethical guidelines and best practices for our honesty, integrity, and professionalism.

5:18And these are going to be used to help shape some things within our company, okay? They're gonna be used to help shape our policies and guidelines. So we see that swings right over into our policies and guidelines. And really the key with organizational policies is this image down here. We have this balance going on. And that's what these code of ethics are supposed to do. Help us to balance conflicting needs of laws and regulations with the need for a business to succeed.

5:52And that's because many businesses face regulations and laws that they have to abide by. They need to be compliant with them. And sometimes those can make being successful in business, difficult. They can cost a lot of money. They can make things hard on us. But the thing is, when it comes to our organizational code of ethics, it's really there to also help us to balance these two things out, so that they can both coexist. And of course, if employees or folks in the organization are not abiding by these codes of ethics, well, it can result in repercussions such as employee termination.

6:29And nobody wants that. So here, we see that not only do we need to abide by the ISC Squared code of ethics, but of course also our organizational code of ethics as security professionals. And we need to understand the importance of these ethics, and understand the expectations that we practice ethical behavior. That's what this has been all about. I hope this has been informative for you, and I'd like to thank you for viewing.

0:01Today we're going to talk about the CIA Triad. And no, this isn't the Central Intelligence Agency, although that would be fun, but it's a little bit different. So we're gonna talk about confidentiality, integrity, and availability, that is the CIA triad. So with no further ado, let's jump in and get started. So the CIA triad, what is it? Why is it important? Well, the CIA Triad, "TRI" meaning three, has three sides as we can see in this drawing.

0:32Confidentiality, integrity and availability, those are the three pieces of the CIA triad. Now why is this important? Because within cybersecurity and information security, we are working to ensure, that is key here, that it's kind of our job is to ensure this CIA triad. So what does this really mean? Well, it means we want to work to provide confidentiality, and work to provide integrity to our data, and the availability of our data.

1:09So let's go a little further now and talk about each of these individually and and kinda the role that they play in this triad. So we're gonna start off with confidentiality. We see Mr. Hush Hush down here. Now, when it comes to confidentiality, what we're trying to do is make sure that only those who are authorized to access our data can access it. That means those who are unauthorized, well we don't want those folks to be able to access our data.

1:40We want to keep it confidentiality, we want to restrict access to it. We want to use something called the premise of least privilege. And we're gonna dive into what this means more later on. But we're gonna practice something called "least privilege", meaning we provide the least amount of privilege necessary for someone to do their job. So if we have hundreds and hundreds of thousands of files and folders and directories and all of the wonderful resources that we have, we don't want to give everybody out there access to all of these things.

2:16Absolutely not. We want to remove that. We wanna say, this person needs access to only this. Maybe this person needs access to these things over here, and this one to a couple of these over here, but that's all that they need access to, that is least privilege. Now why is that important when it comes to confidentiality? Because, if everybody has access to everything, well then, well, there's no confidentiality at that point necessarily because we need to control who can have access to everything. We wanna make sure that those unauthorized individuals don't have access to any of the things that they shouldn't have access to.

2:52So really when we're talking about confidentiality, what we've been talking about here is something called access control. And there are several different types of access control, and we're gonna dive into those later on. But this all on this right side of the screen here, well, that's access control in a nutshell. What else can we use to provide confidentiality to our data? Well just think about this, if you send an email to someone, it's gonna go out across the internet. And what is out there on the internet?

3:23Well, there's lots of things on the internet. It goes through different service providers as it jumps through various networks to get from point A to point B to point C, and maybe finally down here to your destination where that user can open up the email and read the contents. Well, as your emails and other data traverse the wide world of the internet, which is the wild wild west out there, who's to say someone can't go out there, and take a look at your email?

3:54Well, because it's absolutely possible these emails are sent in plain text. So what can we do to combat this? Well, let me make a little room here. We can use something called encryption. So we have our email over here. What we're gonna do is we're going to use a key of some sort and we're going to encrypt this email so that anybody that doesn't have that key, they cannot read the email. So as it traverses the internet and all the different paths it may take before it gets to its final destination, anybody out here who doesn't have the key, they're not gonna be able to read that email, meaning we are going to maintain the confidentiality of the contents of that email.

4:35Hey, super cool. So then when it gets down here to its final destination, the user can take their key and they can open that email and read it and voila, there we go, we've achieved confidentiality. So there's a couple different pieces. We can use encryption to help with confidentiality, we can use access control to help maintain confidentiality. And why are we maintaining confidentiality in the first place? Because our data can be sensitive, it can have trade secrets in it.

5:06Maybe it has sensitive privacy information in it. We need to maintain control of our data, and part of that is maintaining the confidentiality of the data. So that's the C part of the CIA triad. What about the I? Good old integrity. There we go. So integrity. This is ensuring that our data is accurate. So why is our data not accurate? Did we mess something up? Did we miscalculate something? No, no, no, no, no, something totally different.

5:38This is dealing with making sure our data hasn't been tampered with. Because, just same example we used before when we were sending an email, if I go over here and I take an email and I send it out, and it goes out across the internet and through all the different routers and devices out there to get to where it's finally going through different service providers and such, and the user gets their email. And originally I was placing an order, so I want to order part number 1234, and I want to order a quantity of five.

6:12Okay? That's what was in my email. Well, if someone tampers with that email and they change that order to part number 6321, and a quantity of 500, well, that completely changes my order. And that is why we need to protect integrity, not to protect our orders necessarily, but sure, of course that's one example. But because we need to ensure that our data is accurate, we don't want it to be tampered with, we need to ensure the integrity of our data, and some different ways that we can do this, we can perform error checking.

6:56So for example, in this instance, if I use some type of mathematical equation to give me an output of what my original message equals, maybe it actually equals X, 3, 2, 6, 9. You know, in some mathematical equation, actually we call this hashing, and this value now represents the email. So I could actually attach this to the email, and then when it gets to the other side, we could run that mathematical algorithm again. And here it would equal Y, 3, 1, 1, 2.

7:31All right? So that's what that equals. So if I take my, out of this message X, 3, 2, 6, 9, does this value equal that value? Well the answer is no. So that means that our message was tampered with, and this is part of something like error checking. We're looking to see if our data was tampered with, and the integrity has been compromised of our data. And if you think about this is one example, right? But what about when it comes to medical information?

8:01Well, that could be very dangerous as you could imagine. If someone's medical records were tampered with and we didn't have the integrity of the data, well maybe something they were allergic to gets changed in their medical records and then they get a treatment and they have an allergic reaction, you see where this could go, this could be very dangerous. So again, we're looking to protect the integrity of our data and really one of the best ways we can do that is through an error checking or something we call hashing, which uses a mathematical algorithm to calculate a value, just like we looked at in this example.

8:38All right, so that's the "I" leg of our CIA triad. We've got one more to go, that is the "A" or availability. So here we're looking to make sure our data is, well, it's available, meaning we can use it. If our data is not available to us to use, well what good is it, right? We can't actually access it and use it. We've gotta have it available to us. So how can we, you know, protect our data and make sure it's available? Well, one of the things we can do is practice access control.

9:10Just like we talked about in our confidentiality, access control. If we allow unauthorized users to access our data, well, guess what? Those unauthorized users, whoa... Well, they could go out there and delete our data. Well then it's not available to us, or they could change the data and compromise its integrity. So then it's inaccurate. And if it's inaccurate, it's of no use to us, so again, it's affecting the availability. Another thing we could do is put some type of security controls in place to help protect our data, make sure it's available, because we got all those bad guys out there on the internet who might do something like cause an attack against our environment.

9:58And if they're trying to attack, maybe we can put something like a firewall out here, and that firewall is gonna help protect us. So this is a security control, something we put in place to control the situation. And it's related to security. So we could do a firewall, or maybe an intrusion detection system that we could put in place to analyze the traffic as it's coming through into our environment so we can help keep the bad guys out, making sure that our data is available.

10:29We can also build redundancy into our systems. So instead of running our data on one server, we actually spread the data across multiple servers in maybe a cluster so that if we lose one of those servers, we still have our data available to us. So redundancy, we could have redundant power. That's pretty important, because if the lights go out, well guess what? Our servers go down, our infrastructure goes down, we'd lose access or availability of our data.

11:01The same for our HVAC or air conditioning and ventilation. Because when we're dealing with lots of network equipment and servers and such, it generates lots of heat, and if it overheat, it's no longer able to function. Well, it affects the availability of the data on those devices. So it's very important that we have redundancy as part of protection for our availability. So those are the three things that make up the CIA triad. That's our confidentiality, our integrity, and of course our availability.

11:36That's the CIA triad. And that's really what we look to protect within information security. So we're looking to protect all of these things, because when we do that together, when we have all three legs of the CIA triad, well then, we are going to be winning at security and making sure our data is accurate and available, and kept confidential. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00It's time to talk about accountability, privacy, and nonrepudiation. These three things are very important when it comes to security. We need to have accountability and we need to have privacy. And then nonrepudiation is something that comes into play a little later on. But we're gonna discuss all these right now. And we're starting off with accountability. And it's very important that we have accountability. And accountability is holding someone accountable for their actions.

0:32And it's very important that we do this because without accountability, there are no consequences for not following things like code of ethics and policies and procedures and anything else laid out by the organization. So again, accountability, holding somebody accountable for their actions, very important. Because if we didn't have accountability, well then there's no reason for anyone to follow what's been laid out by the organization, like the code of ethics and policies and procedures.

1:06There's no consequences, no accountability. So it's very important that we have that. Otherwise, there would be no repercussions for not following these things. And at that point, there's really no incentive either, because if there's no repercussions, nothing's gonna happen. So you can really just do what you wanna do. That's why accountability is so very important. And next we're gonna talk about privacy. Now, according to Miriam Webster, privacy is freedom from unauthorized intrusion.

1:38And this is what we want for our personal data and our lives, right? Absolutely. We want freedom from unauthorized intrusion. If we want people to know our business, then we'll post it on social media or we'll tell somebody about it. But otherwise, we want our personalized, our data to be free from unauthorized intrusion. And the same goes for the data in our organizations. The data that our organizations manage. We want to keep it free from unauthorized access.

2:09And there are many laws and regulations surrounding data privacy, which we're gonna cover later on in this course. But for now, just to understand, privacy is freedom from unauthorized intrusion, and we want to keep our data private. Absolutely. We don't want unauthorized access to our data. All right, so that's accountability and privacy. Next up we're gonna talk about nonrepudiation. So it is a strange sounding word. So let's go ahead and break this down. We're gonna start with repudiation.

2:42Now, repudiation is the ability to say that you didn't do something. Okay? That's what repudiation means. Basically, you know, "I didn't send an email" or "I didn't open a file," so that is repudiation. But if we put non in front of that, so we have nonrepudiation, it means that you don't have the ability to say this, right? So let's talk about some of the examples of nonrepudiation.

3:14So when it comes to emails, if you have nonrepudiation, you can't say that "I didn't send this email." So as it goes out to its recipient over here and the recipient reads it and says, "Hey, did you send this email?" You cannot say, "I didn't do that." See, that's not an option with nonrepudiation. So we have proof that the person sent the email. Okay, what about accessing a file? Maybe making changes to the file?

3:46So we change a little bit in the file, and the question comes about, "Hey, who made the change to this file? Did you do that?" With nonrepudiation, the person can't say, "I didn't do it," because we have proof that they did. So really, with nonrepudiation, we're looking to prove that someone did something. That's what it comes down to. But this isn't necessarily a bad thing. We're not looking to catch someone in a crime or something necessarily. It could be that you want to prove that you sent it.

4:17"See, I sent this file, I changed that file, I sent the email," whatever it is. So you can prove that you did. But how can this be done? Well, when it comes to proving that you sent an email, let's say, you could use something called PKI, and that is our Public Key Infrastructure. And this is dealing with encryption keys. So earlier we had talked about using encryption to encrypt an email to maintain its confidentiality.

4:48So if I take my key right here, and I go ahead and I use that key to digitally sign my email, which basically means you take the key and it runs that hashing algorithm that we talked about earlier, and it puts that data into the email. So since you are the only one who has access to this key, it's your private key, you hold it safe, and you don't let anybody else have access to it. That way when this email goes out and you've digitally signed it, you can say, "I sent it."

5:22And you have proof because you signed it with, that's right, your key right there. So that is an example of nonrepudiation. You want to prove that you sent it. And since you're the only person on earth who has access to that private key, you can prove it. You've digitally signed it. And we can sign files as well. You can sign various objects, but again, oftentimes we use PKI, or Public Key Infrastructure, with our private key to sign a piece of data to prove that you did something with it.

5:56And that is all about nonrepudiation. You wanna make sure that you can prove that you did something with some digital assets, like files. And again, also it could be the other way. So if you're looking to see if someone did something, you can find out again by nonrepudiation. I hope it's been informative for you and I'd like to thank you for viewing.

0:01Within information security, we're always trying to control the security of our environment. We're protecting the CIA triad. We're protecting our assets. And one of the ways that we do this is we practice some things like least privileged and segregation of duties. These are two ways that we can control access that people have to our assets. We don't want them to have too much access because then they could do nefarious things and we don't want that to happen. So let's jump in and talk about these.

0:32So let's talk about principle of least privilege. The idea is you should only be provided with enough access to do your job and no more. Now, it is very important that we are given enough access to do our job, otherwise we wouldn't be able to do it. And that is detrimental to the organization, right? It hurts the organization if people can't do their job. So we have to make sure they have enough permissions. That is key. Enough, but not too much.

1:06And that is the principle of least privilege, because if you give too much permission or too much access, well that's not good either, because then nefarious activities can be carried out. Just think about this, if in your organization you've got a thousand users in there and those thousand users have access to everything in your organization data-wise, well they don't need that access.

1:38And so if someone is feeling like they've been wronged by the organization, again, they have access to everything. So they would be able to go out and access sensitive information and take that information and maybe sell it to a competitor or leak it online, whatever it might be to cause harm to your organization. And that would be an insider threat. But we can prevent this from happening by practicing principle of least privilege.

2:11We only give people enough access to do their job, okay? That's where this comes into play. Now, let's talk about a couple of examples. Let's say we have an email administrator. So there is our email server here, and they are the email administrator. They manage all the email for our organization. Well, we need to make sure that they have administrative access into our mail server. Absolutely, that's how they do their job. But if I have over here, there we go, my accounting server, do I need to give the email administrator administrative rights or any permissions at all to my accounting server?

2:53Well, the answer is probably not, and I wouldn't want to. They don't need access to that, okay? And another example, I've got this help desk technician over here working away at the help desk, helping our folks out, and he's working on fixing end user problems, okay? So that means that he probably doesn't need any type of administration access to the servers over here. He needs to have access to our end user computer so he can help 'em out, alright?

3:26So these are examples of principle of least privilege. So again, the key is least privilege. I'm gonna drive this home. Least privilege. When users have too much privilege, they can gain access to data and services that they don't need access to. And that's where we can run into risks such as insider threats or damage from viruses. What, damage from viruses? Yes, absolutely.

3:58So let's say I've got a user over here and everybody has access to everything. So we've got all of our digital assets over here, all of our files and all of our servers are over here and all these things, right? If this user sitting right here has access to everything and he goes ahead and receives a phishing email, downloads it, and gets a virus, well, the way the virus works is it uses the permissions of the user logged into the computer.

4:31If the user has administrative permissions over everything, guess what? So does the virus. That means it can spread and infect everything. And this virus could be malware, it could be ransomware. Who knows? It's something that we don't want in our environment. And again, principle of least privilege. So if this user only had permissions, let's change this up here. If this user only had permissions in all these things to these files over here, well this malware, virus, or ransomware could only access those files.

5:05It couldn't access or do anything else to the rest of our resources. And that is ideal. That's what we're looking for. So not only does it protect against things like insider threats, it also protects against malware, viruses, ransomware, et cetera. So again, least privilege helps to protect our environment. And too much privilege introduces risk. And we've talked about risk before and managing risk and risk is something that we in information security are always looking to reduce.

5:38We need to keep a handle on risk. And one of the ways that we can do it is practice principle of least privilege. And yes, there's always going to be risk, but we need to manage our risk. We don't wanna let it run free. We wanna manage it when we have the opportunity to do so and to minimize it by doing things such as, again, practicing principles of least privilege. And now onto segregation of duties, also known as separation of duties, is the idea that we don't want any one person to have too much authority so they can carry out a sensitive process all on their own, okay?

6:18Now, why would we want to do this? We wanna prevent someone from being able to take advantage of that situation. And let's go ahead and talk about some examples here. So one example is, think of accounting and payroll. Does the person who enters payroll data into the accounting system approve the paychecks? Probably not. Because if they did, let's say this person here, they entered the payroll information into the system and they approved the payroll so that the checks can go out, well, they could pay themselves or anybody else, whatever they wanted to, right?

6:56Absolutely. What's to stop 'em? Well, an auditor would catch them doing this eventually if auditing was being done. But by that time, it's already done. Alright, let's talk about another one. How about expense reports? With expense reports, does the person submitting the expense report also approve the expense report? Well, again, probably not, because if this person submitted an expense report and approved the expense report, they could expense anything they wanted to.

7:27A vacation. Hey, there you go. How about a vacation or a big old TV or something like maybe, I don't know, a boat or something. Who knows? They could put anything they wanted to on that expense report and approve it because they're the only ones seeing it. And again, you see what we're finding here is a single person having too much authority or permissions and they're able to take advantage of a situation. And this is something we're trying to avoid. That's why we have segregation of duties. Now, these are a couple examples of non-IT systems.

8:01What about examples when it comes to IT systems? Well, let's talk about data backups. That is a very important job. And if we have a backup admin over here, so this is our backup admin who is in charge of doing all the backups and performing test restores and making sure that everything with our backups is working successfully. Hey, that's great. Now, but what about when it's time to audit these backups?

8:34Because we should be performing audits, okay? And that's because we wanna make sure things are being done properly. We want to ensure that our backups are successful, that we are actually doing test restores. These are all things we should be doing, and that's what the audits are there to ensure are being done. However, if the backup admin takes care of things like the backups, okay, and test restores, and we want to audit this to make sure they're being done, would I assign the backup admin as the auditor for this?

9:08Well, no, I wouldn't because then the person doing the work is the one auditing the work. And that is a conflict of interest. And that's why we need to ensure it is someone else, maybe a third party. So it's someone other than the backup admin, it could be even somebody who's not in IT. And that's because we need to ensure that these backups are being done properly and our test restores are being done properly as well. And that requires someone else performing the audit.

9:42We don't want the same person auditing the work that they are doing. That just does not make sense. That's known as a segregation of duty. We segregate that. You got the person doing the work over here and you've got the third party auditor over here. And that's a prime example of using segregation of duties within IT systems, alright? So this is why we practice segregation of duties. It's important to information security and it helps us, that's right, reduce risk.

10:13Because if you think about it, if you've got that backup admin over here doing the backups and they're not doing the backups properly, our backups are failing and we're not doing test restores. We don't even know if the restores are gonna work. If we do not audit and find this out, guess what? When there is a problem, we have a serious incident on our hands because the risk is through the roof. Because we're not auditing, we're not finding these things out, and we're gonna be up the creek without a paddle.

10:47And that is not a place you wanna be my friends. So again, we're reducing the risk of our own personnel taking advantage of situations to gain something. So if we practice the segregations of duties, it's gonna help us make sure that this doesn't happen and it's going to lower our risk. Absolutely jump for joy. (laughs) All righty, so that is segregation of duty. I hope it's been informative for you and I'd like to thank you for viewing.

0:01When we talked about risk, one of the ways that we could deal with risk was to mitigate it or fix the risk. And one of the things we can do to fix a risk or kind of mitigate it and minimize its likelihood of happening, is to implement something called security controls. And that's what we're gonna talk about right now. So the question is, what are security controls? Well, security controls are safeguards and countermeasures that we can put in place to reduce risk.

0:34The security controls attempt to control the outcome of a specific event. And again, it's all about reducing risk. So let's spend a couple minutes talking about what kind of controls we could use in a day-to-day life to reduce risk. Well, do you have a security system like this here in your home or business? Well, you may, many of us do. And we use these to secure our home to prevent people from breaking in and stealing our goods.

1:07Because when they break in and the alarm goes off, it scares them away. Okay, and then it alerts us, hey, someone broke into your house, something's going on. You need to call the police. You know, take action. So this is a type of control to prevent theft of our goods. Another example right here, warning lights. So if you get into your vehicle and you start it up and you get a warning light on your dashboard in your vehicle, let's say, well guess what?

1:38There might be something wrong with your vehicle and you need to get it taken care of before it causes damage. So this is a type of preventative control. Or maybe you use credit monitoring to detect and prevent bad guys from using your credit to purchase various goods, right? Because it helps us to identify suspicious activities with our finances or credit. And these are kind of everyday controls that many of us use.

2:11So I'd say at this point we understand what controls are. You know, the role that they play in security. So let's talk about some ways to reduce risk associated with some specific threats. So let's play a game. Let's play match three and win, alright, so here's what we're dealing with. We have human error over here. We've got viruses and malware, insider threats, and a stolen laptop. And over here we have some controls that we can use to help prevent specific risks from happening, or at least reduce the risk associated with them.

2:49So let's start with human error over here. So with our human error, which of these controls over here on the right do you think would help us to reduce human error? So we have file permission. So those are permissions allowing authorized individuals to access files. We have, that's our file permission. We have drive encryption over here. So this is where we encrypt a hard drive and the data on it so that if the drive was stolen or lost, that the data on it would remain confidential, the bad guys couldn't get at it.

3:25Okay, then we have security awareness training over here, and this is where we train our users so that they can make good decisions and not make errors by clicking on things that they shouldn't or opening files that they shouldn't. Then we have endpoint protection. This is like your antivirus or your anti-malware or endpoint detection and response software that runs on our endpoints. It could be our servers and our laptops and our workstations that keeps viruses and malware at bay. So we're starting off with human error.

3:56Which one of these over here on the right would allow us to reduce the risk of human error? So what do you think about this? Well, file permissions aren't gonna prevent human error, nor is drive encryption. But security awareness training that is going to allow us to train our users so that they can understand the do's and don'ts of security and reduce the likelihood of human error. So there you go. Security awareness training. All right, that's the first one.

4:27Next up is virus and malware. So what are we gonna do with virus and malware? Well, security awareness training is out, we've already chosen that one. So let's see, file permissions, that's users accessing it, drive encryption, it's controlling access to our data on our drives. Okay, but endpoint protection, that was our anti-malware and antivirus. So there we go. Endpoint protection. Alright, let's talk about the next one. This is insider threats. Ooh.

5:00So when it comes to insider threats, would it be file permissions or drive encryption? Well, file permissions is going to allow us to practice access control so that our individuals, our employees and folks only have access to what they need. They don't have access to everything. So that would help protect against insider threat. There you go. And then last but not least, a stolen laptop right over here. So what are we gonna do to protect the data on a stolen laptop? Well, we only have one option left, and that's drive encryption.

5:32So let's go right over to drive encryption. And remember, if we encrypt our hard drive and someone steals the laptop with a hard drive in it, they're not gonna be able to read the data. So that is it. So match three and win, guess what? We matched four. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00So now that we know what security controls are, and we understand that we use them every day, even in our normal everyday lives, not only in information security, well, we're gonna focus now on the information security, based security controls, and more specifically, the three different categories that we use to categorize security controls. So let's get started. So when it comes to security controls, we have three main categories, and that is administrative, physical, and technical.

0:35Those are the three primary categories of security controls. And now, we're gonna dive into each one and discuss them, starting with administrative security controls. So starting off, we're talking about administrative security controls. Think of this as administrative, thinking of reports and paper is involved. You're writing things out and you're reading things, okay? We're not necessarily configuring firewalls or antivirus or putting out anything to help protect access to something. This is more based on things around administrative types of work.

1:09Now, for example, an audit. An audit would be a type of administrative security control. You got these two folks down here performing audit on some data. And another example is the reviewing of file permissions where we're checking people's permissions to make sure they only have the permissions that they need. Because within our organization, we've got lots of people that work there, and people change roles. They move to different departments. And the thing is, when they do this, well, their needs for permissions often change.

1:45So we may add permissions to some users, but oftentimes, we forget to take away permissions that they no longer need. So that's where file permission reviews come into play. We're really trying to make sure that we practice least privilege, like we previously discussed. Another type of administrative security control are policies. We've talked about policies, and along with policies come our procedures, and along with policies and procedures come standards, and these standards outline requirements that we want to follow.

2:18And we could document those within our policies and procedures. And then lastly, something called a baseline. Now, what a baseline is, is these are standard settings, so we'll put that down here. These are standard settings for various objects such as servers and workstations and smartphones and network devices. You know, the list goes on and on and on. Think of a baseline as a recipe, okay? So if you were to bake a cake and you followed recipe, and you know you put one cup of this and one teaspoon of this, and two tablespoons of this and four cups of this, and you put all these together, and out comes a wonderful cake that tastes absolutely beautiful.

3:05Okay, well, if you wanna reproduce that, you're gonna follow this same recipe. Well, that's what a baseline is when it comes to the devices within our environment. They're a group of standard settings. And we do this because when we deploy these devices, let's say we're deploying workstations, we want them to all be deployed the same way. And that's why we want to use a standard way of doing this. It ensures conformity and it reduces human error.

3:36Because if we have this baseline, and it's like a checklist here, where we've got all the things we need to do, when we deploy this workstation, let's say, we want to make sure that we join it to a specific domain. We wanna make sure that we configure certain settings on it, okay? We install antivirus on it. We do this to it, and we do that to it. That way, as we deploy multiple of these devices, they're all the same and they're meeting our organizational standards.

4:06And that's what a baseline is, that's what it does for us. And not just workstation, though. We're talking about servers and network devices and smartphones and tablets, and you know, the list goes on and on. It could be for anything that we deploy. So that's the baseline. So there you go. Those are some different examples of our administrative security controls. Let's talk about auditing and file permission review, and, of course, policies, procedures, standards, and baselines as well. So that's our administrative security controls. Next is our physical security controls.

4:38And think of this as physically protecting our assets. So when it comes to this, we might use something like a man trap, or it may be called a person trap now. But the idea here is that only one person can enter an area at a time. So like this person, goes ahead and types in this code here, and it goes into this contraption here, and the door closes and then the other side opens. But this way, only one person can enter at a time.

5:10You can't have two people in there. There's sensors in here that are checking to see if there's more than one person before opening the door on the other side. And this prevents something called piggybacking. And that's where one person will type in their code and they'll go ahead and walk in, and a second person will walk in before the door closes. Now, this man trap here, this prevents that. But if you think about a general building, and it's got a door there and maybe a keypad here, and somebody types in their digits and their door opens and they walk in, well, somebody coming up behind them can catch the door before it closes and let themselves in without putting their code in, and that's known as piggybacking.

5:49And that's what a man trap or a person trap prevents. Well, you know what else can help secure our building would be a guard, like this here. The guard's gonna sit there and make sure the only authorized personnel can come in. Another option would be security badges. So we've got a badge here, and it may be a proximity badge. And those are badges that when you have a badge reader outside of a door, you hold it up to the badge reader and it reads your credentials on there and it lets you in. Other examples of physical security controls would be fences.

6:22So you may have fences outside your building and maybe there's even some razor wire across the top because you have sensitive material inside and you wanna protect it. It could be lots of different things. It could be on the driveway going into the building. Maybe in front of the building, there are these little pylons that are there and they're metal so that you can't drive into the building, and they protect access into the building. And it could be a receptionist that's sitting in the building, could be lots of different things. So what we're talking about is physical security, and all of these are examples of that.

6:56And lastly, we're gonna talk about technical security controls. Now, this is where we're thinking about configuring things like firewalls and antivirus, and so on and so forth. So these are technical devices that help protect our digital assets, such as here, we have a firewall as an example, absolutely. We could have an intrusion prevention system. That's going to analyze data as it comes into our environment and check its digital signature to see if it is malicious. And if it is, well, it will stop it from entering, and that's what an IPS does.

7:30We also have encryption because we encrypt our data to protect it from unauthorized access. People can't read it if they don't have the proper encryption keys to decrypt and read that data. We also use things like session timeouts. And this is where you have a computer and you're sitting there working on something, and you get up and walk away to go get a snack or something, and you're over there chatting with somebody at the water cooler and you're gone for 15 minutes. Well, maybe after five minutes of inactivity, your screen locks so that you have to reenter your credentials before you're able to gain access to the computer again.

8:08So that would be like a session timeout. We could also use password aging or password rotation, and this is where once your password reaches a certain age, could be 90 days, or let's say it could be 180 days, whatever it might be. Within your company's policies, you're going to have to change your password every so many days. And again, that's to prevent us from keeping the same password for years on end, which increases the risk of that password being compromised or exposed in some way.

8:39And then lastly, along those same lines is account lockouts. So if we have, let's say, five failed login attempts within a 10-minute period, well, maybe the account locks out and you have to call the help desk to get it unlocked. And what this does is helps prevent against brute force login attacks, trying to guess people's passwords. So again, account lockouts are definitely another type of technical security controls. So that is our technical security controls. So again, we talked about the administrative security controls, our physical security controls, and lastly, our technical security controls.

9:19And those are the three different categories and some examples of each of them. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00All right, we're gonna wrap up this series of Nuggets by discussing some other security concepts, such as performing periodic assessments, carrying out audits, and something called due diligence and due care, and we'll discuss what those are and how they differ. So with no further ado, let's jump in and get started. All right, so we're gonna start off by talking about assessing compliance. And within many fields of business, there are needs to comply with regulatory standards and laws.

0:32For example, if you produce a product, and during that process of creating that product, you end up with some wastewater. So say, we've got a barrel of wastewater here. Well, we can't simply go and pour it down the drain. That's just not acceptable according to the EPA or Environmental Protection Agency here in the US. So what are we gonna do with it then? Well, I don't know. We gotta figure out what the EPA says we need to do with it. And again, this goes back to standards and laws. And no matter what area of business that you're in, whether you're in financial or you're in aerospace or you build widgets, really doesn't matter, most times, we have to abide by some type of standard or law.

1:12So most companies will need to comply with some sort of rules and regulations in order to ensure a company is conforming with those laws and regulations. And oftentimes, we perform a self-assessment, and that's where we go and we take a look at those standards and laws that we need to comply with and we go through and check off to see how we are doing. And so we'll have someone inside the organization do that. That's why it's called a self-assessment. Generally, it's not someone from outside the organization that comes in and does an assessment like this. And we do this to make sure that we are in compliance, we're meeting the requirements of the laws and standards that are put forth.

1:51And when we do these, the cost of it is relatively low, and that's because we're using internal personnel, and they're already familiar with what we do as a company, and we don't have to provide them access. They already have the access. So that's where that low cost comes into play. Now, one of the other things other than standards and laws and regulations that we should be assessing are our security controls. We need to go through our security controls that we have in place, and we need to perform assessments to make sure that those security controls are performing as they should.

2:25They're providing us the protection that we need from them. So that is assessing our compliance. Next step, we're gonna talk about periodic audits and reviews. Now, an audit is more of a formal assessment of compliance, and it could be compliance with a specific standard or law, or it could be an audit of our security controls, either way. And generally, this is going to be an outside person. So someone from outside of organization, and they are gonna come in and perform our audit for us and let us know how we're doing.

3:00And when we're auditing security controls, there's something that we need to talk about. So let's put those security controls back up here. When we're auditing against our security controls, we need to have something known as a baseline. And a baseline, when it comes to auditing and security controls, is going to be data showing how that security control works. So for example, if we had a firewall here, let's just draw out a little firewall. And a baseline for a firewall would show what ports or IP addresses are allowed to go through the firewall.

3:37And that way, we could test it. I could take an IP address that's not supposed to be allowed through the firewall, and I could try to access it. And if it's not able to go through, then I would know that security control is functioning properly. And then I would want to pick one that is allowed through, and I'd wanna test it to make sure that that security control is allowing in that through as it should. But you'll see here, if I as an auditor come in and I need to test something, I need to have something that tells me how that is supposed to work, and that is the baseline.

4:08Because if I don't know how it's supposed to work, then how do I know if it is going to pass or fail the audit? And the IT team is going to provide that baseline to the auditor. And they're also gonna have to provide the auditor access into whatever they need access to in order to perform their auditing. So there is a higher cost when it comes to an audit, generally, because we're dealing with an outside individual that has to be paid accordingly, as well as our IT staff. They have to provide them access and create and provide a baseline for them so they can perform the audit.

4:43And there is an added bonus when it comes to having an outside individual perform the audit, and that is that that person has nothing to gain from a control working properly or not working properly, right? Whereas if we had an internal person performing this audit, they may feel pressures from the board or from their managers or from whoever it is to say that everything is working hunky-dory, right? Absolutely, there could be internal pressures like that, but an outside individual most likely isn't gonna have those pressures.

5:18So you're more likely to get an honest review of your security controls and compliance with laws and regulations. So that's our periodic audit and review. And next up, we're gonna talk about due diligence. Now, what does that mean? Well, what due diligence really comes down to is putting forth the effort to understand your information, your organization, your information security policies, procedures, and knowing your environment.

5:49So it comes down to a really a key word, understand. I'll put in here also, know, to know. So really, due diligence is the effort you put forth to understand, to learn about, to know about your organization or what you're protecting, such as your data. What type of data are you working with? Or types, I could put in here, because there's multiple types of data. What laws surround your data? Where your data is located?

6:20These are all things that you need to know about your data, and that is due diligence. Due diligence is putting forth the effort, again, to understand, to know, to learn about what you are responsible for. And here, we're talking about data. So that's due diligence. Let's talk about due care. Due care is a little bit different. Due care comes down to action. Due diligence was all about learning and knowing and understanding.

6:51But due care is about what actions you take to do something, like monitor your data, to protect your data so that if there is an incident, you are able to manage your data and make sure it's available and protected. Now, when it comes to due care and due diligence, this isn't only information security-related. This comes down to everything in your organization. But we're talking about data and protecting our data. So if we talk about due care of data protection, we would wanna make sure that we're monitoring, we're protecting it.

7:25We have firewalls, we have other kinds of things. We have endpoint security. We're performing backups of our data. We're managing access control for our data. And these are types or examples of due care when it comes to managing data. So again, due care is all about action. Now, let's take an example here of due diligence versus due care, and this is all about owning a dog. So over here, we have a Wikipedia down here.

7:59So this is using a Wikipedia to learn about something. Over here, it looks like we're doing some researching and asking questions. So here, obviously, we're not doing a whole lot other than research. All right, so we're learning over there. And then over here, we have a dirty dog that needs to be cleaned. We need to take our dog for a walk, and we need to make sure the dog doesn't get into trouble. So over here, these are more action items. So over here, we have learning. And over here, we have actions.

8:30Now, which is due care and which is due diligence? Well, due diligence was putting forth the effort to understand or learn about something. So obviously, due diligence is this activity down here, whereas due care was all about action. So that goes right over here into our action. So there's a good example of due care versus due diligence. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00It's validation time, and we're gonna validate the information that you learned during this skill, and we talked about security controls, and here your manager assigned you a task coming up with two security controls that you can implement at your organization to help protect your data backups. So what two did you come up with? I'm gonna go through the four that I came up with very quickly. The first one is going to be an audit or assessment. Performing audits and assessments would help us make sure that data backups are being performed and according to the way they're supposed to be performed, whether it's every night or every other day, just depending on what's going on in the organization.

0:40So an audit or assessment, that's a great thing to do. Next would be performing a test restore. So we got our little scientist over here doing some type of experiment. The idea is we wanna take our backup data there and we want to restore it somewhere to make sure that our backup applications and procedures are working properly so that we know when it's time to restore if we need to for some reason that we can. Another one would be to store backups offsite. And the idea here is maybe we have all of our data over here and we wanna back it up to the cloud or to another location.

1:16That way if there's some type of breakout, whether it's ransomware or some type of infection, and it infects our local storage, well, it's not going to infect our offsite backups. So keep that in mind. That's a good option there. And then lastly, we're gonna go back to our administrative types of security controls. And we're talking about mandatory vacation. That's right, if our IT folks have to perform or experience or enjoy, let's put it that way, a mandatory vacation, somebody else fills in for them, and again, we're getting a second set of eyes on the backend at that point in time.

1:51So those are four different types of security controls that we could implement to make sure that our backups are being performed correctly, that our backup procedures work correctly, that our software and hardware's working correctly, and that we're protecting our backup data from security threats. So there you go. Hopefully you had at least one of these. If not, cool. You know what? There's lots of different controls you can implement. These are just a couple of them for us to take a look at and discuss. Congratulations on finishing out the discussing ethics and security concept skill.

2:27I hope this has been informative for you, and I'd like to thank you for viewing.