1
00:00:06,098 --> 00:00:07,980
- Welcome to Lesson 2:

2
00:00:07,980 --> 00:00:10,800
Summarize Fundamental Security Concepts.

3
00:00:10,800 --> 00:00:12,390
This is such an interesting lesson,

4
00:00:12,390 --> 00:00:13,950
because there are five sub-lessons

5
00:00:13,950 --> 00:00:17,610
that all focus on these very
fundamental security concepts.

6
00:00:17,610 --> 00:00:19,620
Some like, what we're going to talk about

7
00:00:19,620 --> 00:00:22,830
in this Lesson 2.1: Security
and Privacy Principles,

8
00:00:22,830 --> 00:00:24,180
are tried and true,

9
00:00:24,180 --> 00:00:25,980
and some like what we're gonna do next

10
00:00:25,980 --> 00:00:28,140
in the next lesson, Zero Trust,

11
00:00:28,140 --> 00:00:30,030
is really emerging,

12
00:00:30,030 --> 00:00:34,140
but regardless of the age of
the principle or the concept,

13
00:00:34,140 --> 00:00:38,280
they're ones that are really
fundamental and foundational

14
00:00:38,280 --> 00:00:41,280
to how we design and support and implement

15
00:00:41,280 --> 00:00:43,050
and manage and monitor

16
00:00:43,050 --> 00:00:46,410
our information security
or cybersecurity programs.

17
00:00:46,410 --> 00:00:50,493
So let's start in with 2.1,
Security and Privacy Principles.

18
00:00:51,510 --> 00:00:53,100
Now, I bet this looks familiar.

19
00:00:53,100 --> 00:00:57,090
This is our information
security CIA triad.

20
00:00:57,090 --> 00:00:58,230
This picture's been around

21
00:00:58,230 --> 00:01:00,810
for really as long as I can remember.

22
00:01:00,810 --> 00:01:02,760
It's the three components

23
00:01:02,760 --> 00:01:05,100
of an information security program,

24
00:01:05,100 --> 00:01:09,180
confidentiality, integrity,
and availability,

25
00:01:09,180 --> 00:01:10,020
often referred to

26
00:01:10,020 --> 00:01:13,530
as our absolutely fundamental principles,

27
00:01:13,530 --> 00:01:14,910
that the majority of the decisions

28
00:01:14,910 --> 00:01:17,130
you will make in information security

29
00:01:17,130 --> 00:01:18,120
are going to be tied

30
00:01:18,120 --> 00:01:22,560
to confidentiality,
integrity, or availability.

31
00:01:22,560 --> 00:01:25,320
Now, I'm often asked, okay,
but which is more important?

32
00:01:25,320 --> 00:01:28,500
And my answer always is, well, it depends.

33
00:01:28,500 --> 00:01:29,520
What's it depend on?

34
00:01:29,520 --> 00:01:32,610
It depends on the strategic
needs of your organization.

35
00:01:32,610 --> 00:01:35,670
For some organizations,
confidentiality is paramount.

36
00:01:35,670 --> 00:01:37,590
For others, it may be integrity.

37
00:01:37,590 --> 00:01:39,960
For others, it may be availability.

38
00:01:39,960 --> 00:01:42,270
For others, it may vary
by business unit, right?

39
00:01:42,270 --> 00:01:44,133
For others, they all may be equal.

40
00:01:45,330 --> 00:01:47,490
So you really need to get to know

41
00:01:47,490 --> 00:01:50,130
what is it that your organization needs

42
00:01:50,130 --> 00:01:52,983
when we're applying these
fundamental principles.

43
00:01:54,180 --> 00:01:57,720
So let's define them,
starting with confidentiality.

44
00:01:57,720 --> 00:01:59,490
Confidentiality is assurance

45
00:01:59,490 --> 00:02:01,650
that information is not disclosed

46
00:02:01,650 --> 00:02:05,400
to unauthorized, persons,
processes, or devices.

47
00:02:05,400 --> 00:02:09,180
Confidentiality is going to
cover data in all its states,

48
00:02:09,180 --> 00:02:13,380
in storage, during
processing, and in transit.

49
00:02:13,380 --> 00:02:16,290
You know, confidentiality
really is a principle

50
00:02:16,290 --> 00:02:18,330
that most of us learned
in kindergarten, right?

51
00:02:18,330 --> 00:02:20,340
When somebody told us a secret,

52
00:02:20,340 --> 00:02:22,680
we knew that we weren't
supposed to share that secret

53
00:02:22,680 --> 00:02:26,370
with anyone else, unless
they were authorized.

54
00:02:26,370 --> 00:02:28,650
So confidentiality.

55
00:02:28,650 --> 00:02:30,900
Next up is integrity.

56
00:02:30,900 --> 00:02:34,440
Integrity is the principle
that systems are trustworthy,

57
00:02:34,440 --> 00:02:36,180
and that they work as intended,

58
00:02:36,180 --> 00:02:39,390
and that the data is
complete and accurate.

59
00:02:39,390 --> 00:02:40,470
So what we're doing here

60
00:02:40,470 --> 00:02:44,520
is we're protecting from
advertent or inadvertent,

61
00:02:44,520 --> 00:02:48,420
malicious or non-malicious,
or accidental changes,

62
00:02:48,420 --> 00:02:52,050
and really to focus on that
we can trust our systems,

63
00:02:52,050 --> 00:02:55,170
that our systems are trustworthy,
they work as intended,

64
00:02:55,170 --> 00:02:58,500
and the data is complete and accurate.

65
00:02:58,500 --> 00:03:00,930
And our third principle is availability,

66
00:03:00,930 --> 00:03:04,110
availability being the principle
that information systems

67
00:03:04,110 --> 00:03:06,960
as well as the supporting infrastructures

68
00:03:06,960 --> 00:03:10,170
are operating and accessible when needed.

69
00:03:10,170 --> 00:03:14,223
Confidentiality, integrity,
and availability.

70
00:03:15,690 --> 00:03:17,790
Now, there are four supporting principles

71
00:03:17,790 --> 00:03:19,740
that I wanna share with you as well.

72
00:03:19,740 --> 00:03:20,970
Authentication.

73
00:03:20,970 --> 00:03:24,900
Authentication is the process
of verifying identity, right?

74
00:03:24,900 --> 00:03:27,303
We wanna make sure we know who you are.

75
00:03:28,290 --> 00:03:32,430
Authorization is the
process of approving access.

76
00:03:32,430 --> 00:03:33,720
Accounting is the process

77
00:03:33,720 --> 00:03:37,650
of tracing actions to
their source, who did what.

78
00:03:37,650 --> 00:03:40,740
And lastly, non-repudiation is the process

79
00:03:40,740 --> 00:03:43,923
of assuring the validity
and the origin of data.

80
00:03:44,970 --> 00:03:46,170
And in subsequent lessons,

81
00:03:46,170 --> 00:03:49,710
we're gonna dive deep into
authentication, authorization,

82
00:03:49,710 --> 00:03:53,343
accounting, and
non-repudiation principles.

83
00:03:56,190 --> 00:03:59,190
So this has been our tried
and true triad forever now

84
00:03:59,190 --> 00:04:01,470
in information cybersecurity.

85
00:04:01,470 --> 00:04:03,750
But I wanna add another triangle.

86
00:04:03,750 --> 00:04:05,190
Now, I know it's not a triad anymore,

87
00:04:05,190 --> 00:04:07,830
and I don't know what this new
shape would really be called,

88
00:04:07,830 --> 00:04:11,490
but I think that every
cybersecurity practitioner

89
00:04:11,490 --> 00:04:15,270
really, really needs to
take to heart and understand

90
00:04:15,270 --> 00:04:16,800
privacy principles,

91
00:04:16,800 --> 00:04:18,510
that we can no longer say, "Oh, privacy.

92
00:04:18,510 --> 00:04:20,040
That belongs to another department.

93
00:04:20,040 --> 00:04:22,680
Oh, that's part of legal, or
that's part of compliance."

94
00:04:22,680 --> 00:04:26,040
Privacy is an absolutely
critical component

95
00:04:26,040 --> 00:04:29,640
of the decisions that we
make, the actions that we take

96
00:04:29,640 --> 00:04:32,010
in information security or cybersecurity.

97
00:04:32,010 --> 00:04:33,870
So I want us to pause here,

98
00:04:33,870 --> 00:04:35,820
moving a little bit away from our CIA,

99
00:04:35,820 --> 00:04:38,070
and talk about, okay, so what is privacy,

100
00:04:38,070 --> 00:04:42,753
and how does privacy differ
from confidentiality?

101
00:04:44,400 --> 00:04:47,070
Privacy succinctly is the
right of an individual

102
00:04:47,070 --> 00:04:50,869
to control the use of
their personal information.

103
00:04:50,869 --> 00:04:54,060
Now, more and more, consumers, end users

104
00:04:54,060 --> 00:04:56,310
expect their privacy to be respected

105
00:04:56,310 --> 00:04:58,980
and their personal
information to be protected

106
00:04:58,980 --> 00:05:01,740
by the organizations with
which they do business.

107
00:05:01,740 --> 00:05:03,990
And I would say the same
is true internally, right?

108
00:05:03,990 --> 00:05:06,810
Employees expect their
privacy to be respected,

109
00:05:06,810 --> 00:05:09,960
stakeholders expect their
privacy to be respected

110
00:05:09,960 --> 00:05:13,500
and any personal information
that is collected

111
00:05:13,500 --> 00:05:15,480
should be protected by the organizations

112
00:05:15,480 --> 00:05:17,070
with which they do business.

113
00:05:17,070 --> 00:05:19,740
And data privacy controls
relate to actions

114
00:05:19,740 --> 00:05:23,670
regarding what data we're gonna
collect, how we're using it,

115
00:05:23,670 --> 00:05:26,190
how do we notify someone what
we're doing with their data,

116
00:05:26,190 --> 00:05:28,800
how do we ensure that it's
kept accurate and up to date?

117
00:05:28,800 --> 00:05:30,330
And how do we make decisions

118
00:05:30,330 --> 00:05:33,060
about who it's going to be shared with?

119
00:05:33,060 --> 00:05:35,130
Now, that's really different, right,

120
00:05:35,130 --> 00:05:37,410
than the protection mechanisms
that we're putting in place

121
00:05:37,410 --> 00:05:40,470
of confidentiality,
integrity, and availability.

122
00:05:40,470 --> 00:05:43,500
Because when we apply those principles,

123
00:05:43,500 --> 00:05:45,990
generally, we are applying
those fundamental principles

124
00:05:45,990 --> 00:05:48,120
to data that is already in our possession,

125
00:05:48,120 --> 00:05:50,040
and we're not making any decisions about,

126
00:05:50,040 --> 00:05:51,180
well, should we have it?

127
00:05:51,180 --> 00:05:52,013
Should we not have it?

128
00:05:52,013 --> 00:05:53,220
Should we have collected it?

129
00:05:53,220 --> 00:05:55,200
How are we using it, right?

130
00:05:55,200 --> 00:05:56,850
All of that happens separately.

131
00:05:56,850 --> 00:05:59,220
It all happens in the
privacy realm, right?

132
00:05:59,220 --> 00:06:02,640
Our data security controls
say we wanna make sure

133
00:06:02,640 --> 00:06:03,510
that we are protecting

134
00:06:03,510 --> 00:06:06,990
the confidentiality,
integrity, and availability.

135
00:06:06,990 --> 00:06:10,320
So let's take a closer look
at those privacy principles.

136
00:06:10,320 --> 00:06:11,160
I wanna share with you

137
00:06:11,160 --> 00:06:13,590
four of the eight OECD Privacy Principles.

138
00:06:13,590 --> 00:06:17,430
You can learn more about the
OECD organization at oecd.org.

139
00:06:17,430 --> 00:06:19,350
There are actually eight
Privacy Principles,

140
00:06:19,350 --> 00:06:21,750
but we're gonna focus
in on the first four,

141
00:06:21,750 --> 00:06:24,240
and I do wanna mention that the majority

142
00:06:24,240 --> 00:06:26,610
of the privacy regulations
around the world,

143
00:06:26,610 --> 00:06:29,400
like GDPR, the General
Data Protection Regulation,

144
00:06:29,400 --> 00:06:33,660
its foundation is in these
OECD privacy principles.

145
00:06:33,660 --> 00:06:35,520
So the first is collection limitation,

146
00:06:35,520 --> 00:06:38,100
and that says a collection
of personal data

147
00:06:38,100 --> 00:06:40,890
should be obtained by
fair and lawful means,

148
00:06:40,890 --> 00:06:42,150
and where appropriate,

149
00:06:42,150 --> 00:06:46,290
with the knowledge and the
consent of the data subject.

150
00:06:46,290 --> 00:06:47,670
The second is data quality,

151
00:06:47,670 --> 00:06:49,650
and that's a personal
data should be relevant

152
00:06:49,650 --> 00:06:50,790
to the purpose collected

153
00:06:50,790 --> 00:06:54,453
and should be accurate, kept
up to date, and be complete.

154
00:06:55,620 --> 00:06:57,180
Purpose specification

155
00:06:57,180 --> 00:06:59,760
is that the purpose for which
data is going to be collected

156
00:06:59,760 --> 00:07:00,660
should be specified

157
00:07:00,660 --> 00:07:03,060
not later than at the time of collection.

158
00:07:03,060 --> 00:07:03,893
So you can't say,

159
00:07:03,893 --> 00:07:04,980
"Oh, I'm gonna collect
a bunch of this stuff,

160
00:07:04,980 --> 00:07:07,163
'cause I bet it would be useful later on."

161
00:07:07,163 --> 00:07:10,470
You have to have a purpose
right from the very beginning.

162
00:07:10,470 --> 00:07:12,150
And then the use limitation

163
00:07:12,150 --> 00:07:14,640
says personal data should not be disclosed

164
00:07:14,640 --> 00:07:17,700
or otherwise used for
purposes other than specified,

165
00:07:17,700 --> 00:07:20,070
so specified in that
purpose specification,

166
00:07:20,070 --> 00:07:22,890
except with the consent
of the data subject

167
00:07:22,890 --> 00:07:25,203
and/or by the authority of law.

168
00:07:27,135 --> 00:07:29,220
Now, whether we're talking about

169
00:07:29,220 --> 00:07:31,410
the fundamental cybersecurity principles

170
00:07:31,410 --> 00:07:33,900
of confidentiality,
integrity, or availability,

171
00:07:33,900 --> 00:07:36,018
or these privacy principles,

172
00:07:36,018 --> 00:07:38,190
I always want you to keep in mind

173
00:07:38,190 --> 00:07:40,890
is that every security
and privacy objective

174
00:07:40,890 --> 00:07:42,780
must be strategically aligned

175
00:07:42,780 --> 00:07:45,330
with the needs of the organization.

176
00:07:45,330 --> 00:07:49,110
And our mission, you and I,
as security practitioners,

177
00:07:49,110 --> 00:07:52,260
is really to integrate those
fundamental principles,

178
00:07:52,260 --> 00:07:56,460
confidentiality, integrity,
availability, and privacy

179
00:07:56,460 --> 00:07:58,260
into business processes

180
00:07:58,260 --> 00:08:00,993
in support of organizational objectives.

181
00:08:01,860 --> 00:08:04,050
And that, my friends, brings
us to a three-second challenge.

182
00:08:04,050 --> 00:08:04,980
You know how to do this.

183
00:08:04,980 --> 00:08:06,510
Five questions, three seconds each.

184
00:08:06,510 --> 00:08:07,983
Get ready to shout 'em out.

185
00:08:09,330 --> 00:08:11,010
Principle that focuses on protection

186
00:08:11,010 --> 00:08:15,123
from unintentional, accidental,
or inadvertent change.

187
00:08:16,440 --> 00:08:18,603
One, two, three.

188
00:08:20,070 --> 00:08:21,720
Integrity.

189
00:08:21,720 --> 00:08:24,510
Question two, the right of an individual

190
00:08:24,510 --> 00:08:27,603
to control the use of
their personal information.

191
00:08:29,190 --> 00:08:30,300
Shout it right out.

192
00:08:30,300 --> 00:08:31,983
One, two, three.

193
00:08:32,910 --> 00:08:33,993
That's privacy.

194
00:08:35,070 --> 00:08:39,270
Question three, principle that
information is not disclosed

195
00:08:39,270 --> 00:08:44,270
to unauthorized persons,
processes, or devices.

196
00:08:44,580 --> 00:08:47,340
One, two, three.

197
00:08:47,340 --> 00:08:48,693
Confidentiality.

198
00:08:49,650 --> 00:08:52,770
Number four, principle
that information systems

199
00:08:52,770 --> 00:08:54,480
and supporting infrastructure

200
00:08:54,480 --> 00:08:57,123
are operating and accessible when needed.

201
00:08:58,260 --> 00:09:00,900
One, two, three.

202
00:09:00,900 --> 00:09:02,490
That's availability.

203
00:09:02,490 --> 00:09:04,050
And here's our last one.

204
00:09:04,050 --> 00:09:07,263
The process of tracing
actions to their source.

205
00:09:09,038 --> 00:09:11,820
I didn't spend a lot of time on this one.

206
00:09:11,820 --> 00:09:14,130
One, two, three.

207
00:09:14,130 --> 00:09:16,290
And that is accounting.

208
00:09:16,290 --> 00:09:17,123
And we'll be talking more

209
00:09:17,123 --> 00:09:20,103
about accounting and accountability
in subsequent lessons.

210
00:09:21,090 --> 00:09:21,930
So that brings us to

211
00:09:21,930 --> 00:09:24,270
our third security-in-action case study.

212
00:09:24,270 --> 00:09:25,560
Remember, the reason we're doing these

213
00:09:25,560 --> 00:09:27,510
is so you can practically apply

214
00:09:27,510 --> 00:09:30,000
the knowledge that you've
learned in this lesson.

215
00:09:30,000 --> 00:09:32,100
So we're gonna read the
case study together,

216
00:09:32,100 --> 00:09:33,450
I'm gonna ask you a question,

217
00:09:33,450 --> 00:09:35,100
then it'll be a great
time to put me on pause

218
00:09:35,100 --> 00:09:36,330
while you work through the answer,

219
00:09:36,330 --> 00:09:37,260
and then you'll come on back

220
00:09:37,260 --> 00:09:39,240
and we'll go through it together.

221
00:09:39,240 --> 00:09:42,090
You're leading a discussion
about internal security.

222
00:09:42,090 --> 00:09:44,610
You launch with defining
the fundamental principles

223
00:09:44,610 --> 00:09:49,610
of confidentiality, integrity,
availability, and privacy.

224
00:09:50,400 --> 00:09:51,870
But as discussion unfolds,

225
00:09:51,870 --> 00:09:54,030
you realize there's a lot of confusion

226
00:09:54,030 --> 00:09:56,377
about how privacy fits in.

227
00:09:56,377 --> 00:09:58,597
"After all," one participant asks,

228
00:09:58,597 --> 00:10:02,460
"isn't that the same as confidentiality?"

229
00:10:02,460 --> 00:10:04,230
So how do you respond?

230
00:10:04,230 --> 00:10:06,750
Go ahead and put me on pause
while you jot down an answer.

231
00:10:06,750 --> 00:10:08,300
Come on back when you're ready.

232
00:10:11,220 --> 00:10:12,750
Well, your response might be

233
00:10:12,750 --> 00:10:15,150
that privacy and confidentiality

234
00:10:15,150 --> 00:10:18,990
are different yet
complimentary principles.

235
00:10:18,990 --> 00:10:23,100
Data privacy relates to
actions regarding purpose,

236
00:10:23,100 --> 00:10:28,100
lawful collection, accuracy,
usage, notification,

237
00:10:29,100 --> 00:10:31,380
and sharing of data,

238
00:10:31,380 --> 00:10:33,420
where confidentiality focuses on

239
00:10:33,420 --> 00:10:36,240
protecting the data in our possession

240
00:10:36,240 --> 00:10:39,870
from unauthorized access or disclosure.

241
00:10:39,870 --> 00:10:41,550
So being able to clarify,

242
00:10:41,550 --> 00:10:44,160
to be able to lead others
through this discussion,

243
00:10:44,160 --> 00:10:47,403
that my friends, is
definitely security-in-action.

244
00:10:48,540 --> 00:10:49,950
All right, there's your word cloud.

245
00:10:49,950 --> 00:10:50,820
You know what to do.

246
00:10:50,820 --> 00:10:52,530
You're gonna look through
every one of these terms.

247
00:10:52,530 --> 00:10:55,050
You're not gonna move
on until you are sure

248
00:10:55,050 --> 00:10:57,630
that you can describe what
each one of these means.

249
00:10:57,630 --> 00:11:00,750
When you're ready, head
on over to Lesson 2.2,

250
00:11:00,750 --> 00:11:02,750
and I'll be waiting for you right there.