Chapter 3: Access Control - Overview Part 2

When dealing with access control, it is important to realize what the three main things are that can be used for authentication. The three keywords here are knows, is, and has. These keywords correlate to authentication by knowledge, by ownership, and by characteristic. A couple of other ideas that should stand out from this section is the idea of strong authentication. All these means is that the authentication process has to contain nit one, but two of the identification characteristics described above.

Chapter 3: Access Control - Overview Part 1

As this chapter opened, I immediately noticed that there was one key concept that I need to comprehend in order to understand the remainder of the chapter. First off, Access Controls are features of security that will determine how users and systems are going to interact with one another. Access means how a subject and an object will share info. A subject is the part that is requesting access, whereas the object is what is actually being accessed. The book also puts it this way; subjects are active and objects are passive. The three main principles of security that were discussed in chapter two are expanded on a bit. A little more about them relating to chapter three:

Availability - resources must be able to be accessed in a secure and timely manner.

Integrity - prevent resources from being changed in a malicious manner or accidentally.

Confidentiality - info cannot be disclosed to individuals or other systems that are not  authorized to view or change it.

I felt the need to reiterate these three principles of security because of their importance.

Chapter 2: IS Governance and Risk Management - Layers of Responsibility

Most of these terms in this section of chapter two I have heard of, but did not understand their role when it comes to security. There is a link below that I found that would be extremely helpful while studying for this portion of the CISSP exam.

http://www.cram.com/flashcards/cissp-layers-of-responsibility-personnel-security-2644286

This site provides descriptions of each of the roles that apply to information security in a flashcard format.

In a nutshell, each role is an important piece to maintaining security within an organization. Some need to be clearly defined from the start in order to implement a successful security effort. Also, rotation of these duties can be helpful when attempting to uncover fraudulent activities.

Chapter 2: IS Governance and Risk Management - Information Classification

Table 2-11 in book helpful for in-depth descriptions. Below is a basic view. 1 = most sensitive.

Commercial Businesses:
1. Confidential - if it got out could seriously effect the company
2. Private - potentially hurt the company
3. Sensitive - extra precautions to avoid accidental modification or deletion
4. Public - Still do not want it disclosed, but not at all detrimental

Military:
1. Top secret - could cause grave damage to national security
2. Secret - if disclosed, leads to security breach
3. Confidential - no one should no about it except people who need to
4. Sensitive but unclassified - minor security breach
5. Unclassified - No sensitive data here

These are just common models of information classification. There could be a lot of variance here depending on the company. Even whole systems should sometimes be classified, not just data. These classifications should exist no matter what form the data is in. Whether it's electronic, on paper, etc. it should all be treated in the same manner.

Chapter 2: IS Governance and Risk Management - Policies, Standards, Baselines, Guidelines, and Procedures

Security Policy -  What role security has in an individual organization. Usually in the form of a statement made by upper management. There are a few different ones. Organizations specific, issue specific, and system specific.

Standards - Directions and mandatory actions within an organization. Really helpful in defining expected user behavior of a system.

Baselines - Used to determine when future changes should be made. A good example is showing the minimum level of protection that should be used in a system.

Guidelines - To me, these are best practices. They are more flexible than explicit standards.

Procedures - Detailed steps to help attain a goal. Companies have a myriad of procedures and steps to get certain things done. Often used in configuration and installation of systems.

All of theses are often in place for auditing purposes. Employees should be informed and aware of all of these in order to be effective.

Chapter 2: IS Governance and Risk Management - Risk Handling

I was fairly familiar with the terms used in this portion of chapter two because I took a risk management class earlier in my college career. Basically, companies have various methods of handing risk available to them such as avoidance, transfer, mitigation, and acceptance. Each method has various costs associated with it. Risk transfer is the safest, but it is improbable that every single risk needs to be transferred. Avoidance is the easiest to use in my opinion, but you cannot always avoid every single aspect of a risk. This is where mitigation comes into play. The company will introduce measures to reduce the risk. A firewall is a good example of mitigation. Acceptance merely means that the risk is simply just dealt with and nothing to protect against it is used. If a risk is accepted, it is usually a small risk with not very many negative consequences associated with it. If the loss is not that big of a deal and the countermeasure is considerably more expensive than the loss, then this risk handling measure would be used.

Chapter 2: IS Governance and Risk Management - Risk Analysis Approaches

Two approaches exist in analyzing risk: quantitative and qualitative. Basically quantitative deals with number calculations while qualitative is a little less logical. It is more focused on opinions and a rating system and the opinions of those conducting the analysis. Equations are associated with the quantitative side. The equations are on page 87 of the study guide. On the qualitative side, scales are often used. As with everything else, there are pros and cons to using each of these approaches. The two that stood out most to me are as follows. Qualitatively, standard do not exist. Different companies use different ways and scales to interpret results. Quantitatively, the calculations can be extremely complicated. Every person involved may not be able to understand what goes into each risk evaluation.