In this section of the course,
we're going to be focused on the fundamentals of security.
Now, before we can dive deep
into any technical discussions around SQL injections
or password cracking or securing your enterprise systems
by configuring your firewalls, we need to first cover
some basics that you simply must understand.
Now, as a cybersecurity professional, you're going to find
that it is really hard to ensure the security
of your networks and systems.
Now, this is hard, not just because we have bad actors
out there who are trying to hack into our networks
and steal our confidential data,
but also, it's hard because we have internal threats too
like our end users who often try to bypass
our internal security controls as well.
Why, well, because there's always going to be
a friction that exists between the security of the network
and the usability or convenience of that network.
Now, let me give you a quick example here
so you can probably relate to it.
Now, at your house, you probably have an internet connection
from your cable provider, your phone company,
or some third party internet service provider.
Regardless of which one you have,
most of these companies send you a single device
that contains the modem as well as a router inside of it
that provides wireless access throughout your house
so you can have a Wi-Fi access point there.
Now, by default, the internet service provider will give you
a preset password that's pretty long and complicated
in most cases.
On the front of my device, for example,
the company is a sticker that says
the name of the wireless network and the password
such as Wireless Network: ATT142DFE
and a long strong password of 3%1WT&!92#SXH.
Now, I don't know about you,
but that's a pretty long and complicated looking password.
Now, most users will simply change this password
to something easier to remember.
Like magic2912 or cupcake#1 or something like that.
Now, while this is great for convenience and usability,
it really does decrease the level of security you have
because it's easier for a cyber attacker
to crack that password because it is short
and it uses dictionary words inside of it,
but that longer, more complex password,
which is normally more secure
is actually really difficult to memorize
and this also brings another critical weakness to it,
which is the fact that it's printed right on the front
of the modem for anybody who walks by to see it
and write it down.
Now, the truth of the matter
is that with security and usability,
we're always going to have these two things at odds.
Even if you create the most secure system in the world,
your end users will try to bypass those restrictions you put
in place because it's making their day job
much more difficult to complete.
So remember, our end users are people,
and people want things easy, they want them convenient,
but as we give them more convenience,
we're usually going to have to loosen up our security posture
a little bit and conversely,
if we try to increase security too much,
we're going to make things so challenging and so difficult
for our users that they're actually going to take away
all that convenience level and they'll try to find ways
around what we've done.
Now, as a cybersecurity professional,
this is a delicate operational balance
that we're always dealing with inside of our organizations.
Our organizations are having to fight this challenge
all the time to be able to support the convenience
that our users want while giving them more security
and this is one of the reasons why we continue
to have cyber attacks and data breaches to this day
because as we give them more convenience,
we loosen up our security.
Now, in 2022, the average major company that had
a data breach spent $4.35 million per data breach.
That is an amazing and large figure,
but the reason it is is because we have
a security versus convenience trade off that's happening
and people have chosen the wrong things to trade off.
Now, we can make things easier for our users
for them to be able get their work done on a daily basis,
but still making sure it's challenging enough
that our threat actors can't hack their way
into our networks, and that right there is the dream,
that's the sweet spot we're trying to obtain.
So in this section of the course,
we're going to start out by covering
the fundamentals of security and before we do that,
we need to cover two important definitions.
Now, whenever you're working
as a cybersecurity professional,
you're going to hear people talk about two key terms
when we're talking about security.
We talk about these as information security
and information system security.
Now, it's important to know the difference
because these are two different terms.
Information security is the act of protecting
the data and information from unauthorized access,
unlawful modification and disruption,
disclosure or corruption, and destruction.
Simply put, when we talk about information security,
we are talking about the data that the systems are holding,
not the systems themself.
Now, on the other hand, we have information system security,
which is the act of protecting the systems
that hold and process our critical data.
That can be a computer, a server, a network device,
or even your smartphone.
Remember, if somebody's talking
about protecting the data itself,
they are talking about information security,
but if they're talking about the devices that hold the data,
now, we're talking about information system security.
Now, in this section, we're going to be focused
on domain 1 and specifically, objectives 1.1 and 1.2.
Objective 1.1 states that you must be able to compare
and contrast various types of security controls
and objective 1.2 states that you must be able
to summarize fundamental security concepts,
and this is what I was talking about when I mentioned
that they don't always put the objectives in the right order
because the thing we need to learn first
is actually objective 1.2 before we can cover 1.1
and that's exactly what we're going to do in this section.
So as we kick off this section,
we're going to start with objective 1.2
and we'll first start out by covering the C.I.A triad.
Now, the C.I.A triad stands
for confidentiality, integrity, and availability,
and these are the three pillars of security.
Confidentiality ensures that information is only accessible
to those with the appropriate authorization.
For example, if you encrypt sensitive files
to only authorize people can read them and decrypt them,
that is confidentiality.
Now, integrity is going to ensure that data remains accurate
and unaltered unless modification is required.
For example, checksums can be used to verify
that a file has not been changed or corrupted
as it moves along our network during a data transfer.
Availability ensures that information resources
are accessible and functional when needed
by authorized users.
So a good example of availability would be your website
when you implement redundancy measures
to ensure it remains online and up anytime
regardless of how much traffic it's receiving.
So even if you have a period of high traffic,
it'll be able to handle that due to your redundancy
and this gives you good availability.
Next, we're going to cover the concept of non-repudiation.
Non-repudiation means guaranteeing that a specific action
or event has taken place and can not be denied
by the parties involved.
For example, if I send you an email and I digitally sign it,
that's going to ensure that I can not deny sending you
that particular message because my digital signature
is attached to it.
Now, in the old days, we as cybersecurity professionals
always talked about the C.I.A triad, but in recent years,
we have now added two new things to it, an N and an A,
and that's non-repudiation and authentication.
This essentially makes it a pentagon more so than a triad
because now, we have C.I.A.N.A, which is five letters
and a five-sided shape is a pentagon.
Now, with the introduction of this authentication
into C.I.A.N.A, we now move into this area
of the AAAs of security,
which we call authentication, authorization, and accounting.
Now, authentication is the process of verifying
the identity of a user or system.
For example, when you try to log in to get to your email,
your username and password is being checked
against a stored version to confirm your identity.
Now, once you've been authenticated based on your identity,
we then move into authorization,
and authorization determines what actions or resources
an authenticated user has permissions to perform.
For example, in a company database,
you as an employee may have the authorization
to view records, but you may not be authorized
to actually edit them.
So you have read permissions,
but not write or edit permissions.
Now, the third area we have is what's known as accounting,
and accounting is the act of tracking your user activities
and resource utilization and typically, we do this
for auditing or billing purposes.
So when you log into your computer,
we're actually logging what you do.
All those user activities on the network are being logged
to be able to monitor them for unusual
or unauthorized behavior and that would be
a good example of accounting.
After that, we're going to cover
the different security control categories and types.
Now, security controls are measures or mechanisms
that are put in place to mitigate risks
and protect the confidentiality, integrity,
and availability of information systems and their data.
These security controls can be grouped into categories,
like technical, managerial, operational,
and physical controls, but we can also discuss
the different types of security controls we have,
like preventative, deterrent, detective, corrective,
compensating, and directive controls.
Then we'll discuss this concept known as zero trust.
Now, zero trust is a newer security model that operates
on the principle that no one,
whether inside or outside of your organization,
should be trusted by default and verification
is going to be required from everybody
who's trying to gain access to your system's resources.
Now, in order to achieve zero trust,
we have to use a control plane and a data plane.
The control plane consists of the adaptive identity,
threat scope reduction, policy driven access controls,
and secured zones.
The data plan, on the other hand,
is going to be focused on the subject and system,
the policy engine, the policy administrator,
and establishing policy enforcement points.
Finally, we're going to take a short quiz to see
what you learned during this section of the course
and review each of those quiz questions fully
to ensure that you can explain each question
and why the right answer was right.
So let's get started diving
into the fundamentals of security
in this section of the course.