MTA Security Terms & Notes (1)

Question	Answer
Confidentiality	Roughly equivalent to privacy. Measures undertaken to ensure confidentiality are designed to prevent sensitive information from reaching the wrong people, while making sure that the right people can in fact get it: Access must be restricted to those authorized to view the data in question. It is common, as well, for data to be categorized according to the amount and type of damage that could be done should it fall into unintended hands. More or less stringent measures can then be implemented according to those categories.
Integrity	Involves maintaining the consistency, accuracy, and trustworthiness of data over its entire life cycle. Data must not be changed in transit, and steps must be taken to ensure that data cannot be altered by unauthorized people (for example, in a breach of confidentiality). These measures include file permissions and user access controls. Version control may be used to prevent erroneous changes or accidental deletion by authorized users becoming a problem. In addition, some means must be in place to detect any changes in data that might occur as a result of non-human-caused events such as an electromagnetic pulse (EMP) or server crash.
Availability	Availability is best ensured by rigorously maintaining all hardware, performing hardware repairs immediately when needed and maintaining a correctly functioning operating system environment that is free of software conflicts. It’s also important to keep current with all necessary system upgrades. Providing adequate communication bandwidth and preventing the occurrence of bottlenecks are equally important. Redundancy, failover, RAID even high-availability clusters can mitigate serious consequences when hardware issues do occur.
Risk Management	Risk management is the process of identifying, assessing, and prioritizing threats and risks. A risk is generally defined as the probability that an event will occur. A threat, which is defined as an action or occurrence that could result in the breach, outage, or corruption of a system by exploiting known or unknown vulnerabilities. The goal of any risk management plan is to remove risks when possible and to minimize the consequences of risks that cannot be eliminated. Risk assessments are used to identify the risks that might impact your particular environment.
Acceptance	(Tolerating the Risk) A common option when the cost of other risk management options such as avoidance or limitation may outweigh the cost of the risk itself. A company that doesn’t want to spend a lot of money on avoiding risks that do not have a high possibility of occurring will use the risk acceptance strategy.
Avoidance	(Terminating the Risk) The opposite of risk acceptance. It is the action that avoids any exposure to the risk whatsoever. Risk avoidance is usually the most expensive of all risk mitigation options.
Mitigation	(Treating the Risk) Essentially concerned with lessening the impact that a particular risk might have. In considering this strategy, we have usually accepted that the risk cannot be readily avoided or transferred and are therefore now only trying to keep the expected loss or damage to acceptable levels.
Transference	(Transferring the Risk) The involvement of handing risk off to a willing third party. For example, numerous companies outsource certain operations such as customer service, payroll services, etc. This can be beneficial for a company if a transferred risk is not a core competency of that company. It can also be used so a company can focus more on their core competencies
Principle of Least Privilege	An information security term that refers to a design objective in IT that states a given user should only be able to access the information and resources he or she requires for legitimate reasons.
Attack Surface	An attack surface consists of the set of methods and avenues an attacker can use to enter a system and potentially cause damage. The larger the attack surface of a particular environment, the greater the risk of a successful attack.
Social Engineering	Social engineering is a method used to gain access to data, systems, or networks, primarily through misrepresentation. This technique typically relies on the trusting nature of the person being attacked.
Physical Security	Physical security is the first line of defense. There are a number of factors to consider when designing, implementing, or reviewing physical security measures taken to protect assets, systems, networks, and information. These include understanding site security and computer security; securing removable devices and drives; access control; mobile device security; disabling the Log On Locally capability; and identifying and removing keyloggers.
Securing Physical Locations	Unauthorized access is gaining access to an organization’s premises, computer resources, and data without consent of the owner. Four Categories for Preventive Measures: Something the user knows (password, PIN) Something the user has (smart card, key fob) Something the user is (biometrics scans) Something the user does (signature or voice recognition)
Securing Physical Locations 2	Physical locks with a key is the oldest method for deterring unlawful entry. Entry systems may use electronic cardkey entry access, RFID chip/badge scanners. Biometrics recognizes a person based on one or more physical characteristics.
Securing Data Physically	Confidential documents should never be left out in the open. Should be properly filed in a secured cabinet or shredded and disposed of properly. Passwords should never be written down. Install privacy filters on monitors. Lock your computer or set to lock automatically In Windows: Win Key + L
Access Control	Access control is the process of restricting access to a resource to only permitted users, applications, or computer systems.
Defense in Depth	Defense in depth means using multiple layers of security to defend your assets. That way, even if an attacker breaches one layer of your defense, you have additional layers to keep that person out of the critical areas of your environment.
Authentication:	Site security must address the need to identify and authenticate the people who are permitted access to an area.
Access control	Once a person’s identity has been proven and authenticated, site security must determine what areas that person has access to.
Auditing	Site security must also provide the ability to audit activities within the facility. This can be done by reviewing camera footage, badge reader logs, visitor registration logs, or other mechanisms.

Next up

MTA Security Terms & Notes (1)

Description

Resource summary

Similar

	Created by Shantal K Green over 4 years ago