chapter 1

a use case describes a goal that an organization wants to achieve.

engineers use it in systems analysis and software development to identify and clarify requirements to achieve the goal.

a user whose defined user goal and is fulfilled by the system

A precondition of a use case explains the state that the system must be in for the use case to be able to start.

A trigger is the initiator of a use case

A post–condition of a use case lists possible states that the system can be in after the use case runs.

The Basic Flow of Events specifies the interactions between the actor(s) and the system for the ideal case, where everything goes as planned, and the actor's goal (the observable result of value) is met

An alternate flow describes a scenario other than the basic flow that results in a user completing his or her goal.

prevents the unauthorized disclosure of data

by using encryption

encryption scrambles data to make it unreadable by unauthorized personnel.

imagine you need to transmit personally identifiable information (PII) via email, you wouldn't want any unauthorized personnel to access that data.

Identification, authentication, and authorization

help ensure that only authorized personnel can access data.

grant and restrict access.

identification: users claim identity with a unique username. 2. authentication: users prove their identity with authentication, such as a password.\n3. authorization: you can grant or restrict access to resources using an authorization method such as permissions.

provides assurances that data has not been changed.

you can use hashing techniques to enforce integrity

by comparing 2 hashes created at different times, if they are the same, the data is the same.

through unauthorized or unintended changes.

simply a number created by applying the algorithm to a file or message at different times.

by comparing hashes.

that data and services are available when needed.

redundancy and fault–tolerant methods.

adds duplication to critical systems and provides fault–tolerance

to remove every single point of failure. (SPOF)

the entire system can fail.

it can tolerate it and continue to operate.

fault–tolerant disks such as RAID–1 (mirroring),\nRAID–5 (striping with parity), RAID–10 (Mirroring with parity) allow a system to continue to operate even if a disk fails.

failover clusters include redundant servers and ensure service will continue to operate, even if a server fails

by adding fault–tolerant and redundancies such as RAID, Failover clusters, backups and generators

load balancing uses multiple servers to support a single service, such as a high–volume website.

uninterruptible power supplies (UPSs) and power generators can provide power to key\n systems even if commercial power fails.

the system's ability to handle the increased workload by scaling up or out.

the system's ability to handle the increased workload by dynamically scaling up or out as the need arises.

patching methods.

methods that help systems heal themselves or recover faults with minimal downtime.

the possibility or likelihood of a threat exploiting a vulnerability resulting in a loss.

any circumstance or event that has the potential to compromise confidentiality.

a weakness

in the hardware, the software, the configuration, or even the users operating the system.

an adverse event or series of events that can negatively affect the CIA of an organization's IT systems and data.

reduces the chance that a threat will exploit a vulnerability.

by reducing vulnerabilities to the threat or\n reducing the threat's impact.

they are implemented by organizations to \nreduce risk.

managerial control, operation controls, and technical controls.

1. preventive controls 2. detective controls 3. corrective controls 4. deterrent controls 5. compensating controls 6. physical controls.

primarily administrative in function. typically documented in written policies.

helps ensure that the day–to–day operations of an organization comply with the security policy.

use technology such as hardware, software, and firmware to reduce vulnerabilities.

attempt to prevent an incident from occuring

attempt to detect incidents after they have occurred.

attempt to reverse the impact of an incident

attempts to discourage individuals from causing an incident.

alternative controls are used when a primary\n control is not feasible.

controls you can physically touch.

Risk Assessments and vulnerability assessments.

they help organizations quantify and qualify risks within an organization so they can focus on the serious risks.

attempts to discover current vulnerabilities.

to reduce and manage risk.

1. awareness and training 2. configuration management 3. media protection 4. physical and environmental protection.

training helps users maintain password security, understand threats such as phishing and malware, and much more.

often uses baselines to ensure that systems start in a secure hardened state.

includes physical media such as USB flash drives, external and internal drives, and backup tapes

physical controls such as cameras, door locks, and environmental controls such as heating and vent systems.

use tech such as hardware, software, and firmware to reduce vulnerabilities.

vulnerabilities

1. Encryption 2. antivirus software, 3. IDS and IPS 4. firewalls 5. least privilege

restrict network traffic going in and out of a network

specifies that individuals or processes are granted only the privileges they need to perform their assigned tasks or functions but no more.

Intrusion prevention system and intrusion detective system. they both monitor a network or host for intrusions and provide ongoing \nprotection against various threats.

to perform specific functions in relation to security incidents

1. Hardening 2. Training 3. Security Guards 4. Change management 5. account disable policy 6. Intrusion prevention system (IPS)

the practice of making a system or application more secure than it's default configuration

guards prevent and deter many attacks

ensures that changes don't result in \nunintended outages

ensures that users' accounts are disabled when an employee leaves the organization.

intrusion prevention system can block \nmalicious traffic before it reaches a network.

to detect vulnerabilities when they have been exploited.

1. Log monitoring 2. Security information and event management systems (SIEM) 3. Security Audit 4. Video Surveillance 5. motion detection 6. IDS

records details of activity on systems and networks

system information and event management system. it detects trends and raises alerts in real–time.

intrusion detection system. can detect malicious traffic after it enters a network.

attempt to reverse the impact of an incident or problem after it has occurred.

1. backups and system recovery 2. incident\ handling processes.

ensure that personnel can recover data if it is lost or corrupted.

define steps to take in response to security incidents.

controls that you can physically touch

attempt to discourage a threat.

1. Cable locks 2. Physical locks

referred to incident response controls, controls designed to prepare for security incidents and respond to them once they occur.

a command used to test connectivity for remote systems

checks connectivity by sending ICMP echo request packets.

if the remote systems answer with ICMP echo reply packets.

resolves a hostname.

you can ping the hostname of a remote system.

it verifies the other system is operational and reachable.

attempts to disrupt systems by sending it to ping requests repeatedly.

to check the connectivity of remote systems and verify name resolution is working

it can send the pings using TCP,UDP, and ICMP.

useful if you're trying to identify if a firewall is blocking ICMP traffic.

shows the TCP/IP/ configuration information for a windows system.

same function as ipconfig but for linux–based systems but has more capabilities than it.

shows the contents of the DNS cache

shows a comprehensive listing of the TCP/IP configuration information for each NIC

erase contents of the DNS cache.

shows the configuration of the first ethernet interface on an linux system

enables promiscuous mode on the first ethernet interface.

enables multicast mode on the NIC. allows the NIC to process all multicast traffic received by the NIC;.

allows an NIC to process all traffic it receives.