Chapter 8: Business Continuity and Disaster Recovery - BCP Project Components

Scope of the project: Important to note that the scope of such a project is not as clear as it might appear. Big companies usually only outline the scope of a BCP for large threats.

BCP Policy: The framework of the BCP. Outlines the actual purpose of the BCP and helps people understand how it is important and why it is so important.

Project Management: SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis is useful here. Each objective of the BCP can be analyzed using this method and is potentially very helpful when designing and implementing a BCP.

Business Continuity Planning Requirements: Companies need to identify the real threats that are there and not ignore them. Failure to do so could lead to greater consequences. The "That will never happen to us" attitude can be detrimental to an organization.

Business Impact Analysis (BIA): Data is collected about business functions is examined and prioritized. A company does this to see which are most critical and valuable in case of a disaster.

Chapter 8: Business Continuity and Disaster Recovery - Intro

Regarding disaster recovery, the main goal is to is to minimize the effects of the disaster. However, the good news is that there are standards and best practices for such a disaster.

1. Develop a continuity planning policy statement - Construct a policy that gives insight on how to develop a BCP. Assign roles that will support it and can carry out the tasks.

2. Conduct a BIA (Business Impact Analysis) - Prioritize critical functions and systems. Calculate risks that have to do with threats and vulnerabilities.

3. Identify Preventative Controls - Implement measures that will counter the risks.

4. Develop Recovery Strategies - Find ways that will bring systems and functions back to operating level.

5. Develop a Contingency Plan - Develop ways that the organization can remain functional in the event of a disaster.

6. Test the plan and conduct training - Test the plan in order to identify and correct flaws. Train employees so that they know exactly what to do in case of a disaster.

7. Maintain the plan - Make sure that the plan is prevalent and that people know about it. Make sure that it is updated when it needs to be.

Chapter 7: Cryptography - Types of Attacks

Ciphertext only Attacks - attacker has the ciphertext of many messages, and each is encrypted using the same encryption algorithm. Most common attack, but hardest to be successful.

Known Plaintext Attacks - Attacker has the plaintext and the ciphertext to messages.

Chosen Plaintext Attacks - attacker has plaintext and ciphertext, but chooses the palintext that gets encrypted to view the ciphertext.

Chosen Ciphertext Attacks - chooses ciphertext to be decrypted and then gains access to the plaintext

*Goal is to figure out the key

Social Engineering - Manipulating others in order to get them to provide information.

Chapter 7: Cryptography - Internet Security

The very first sentence of this section of the study guide is extremely important. The Web is not the Internet. The Web basically runs on the Internet. I have a pretty good understanding of how HTTP works, and that it is stateless by design. It is up to the web developer to handle data persistence. Data can be persisted in one use case, in one session, using cookies, or using a database. HTTP is more secure when running over Secure Sockets Layer. The reason the exchange of credit card information is secure is because of Secure Electronic Transaction technology. It is also to point out the difference between Secure HTTP and HTTP Secure. The first protects each message sent from computer to computer, where the latter protects the channel in which the messages are sent.

Chapter 7: Cryptography - Email Standards

The book describes three main email standards when it comes to cryptography. The first one is the Multipurpose Internet Mail Extension. It's acronym is MIME, and it specifies how file types in email should be transferred and the handled by the recipient of the email. From my understanding, MIME is the reason that when you receive an email with an attachment, the file type is shown before even opening it most of the time. There is an extension to MIME, known as S/MIME where the S stands for secure. At a basic level, it allows for encryption of email and its attachments. It follows the Public Key Cryptography Standards and its algorithms. A second email standard is the PGP, or Pretty Good Privacy. A quote from the study guide describes it best: "I don't know you, but my buddy says you are all right, so I will trust you". It has become the de facto standard for the Internet. The third one is way more complex than the previous two...Quantum Cryptography. Photon polarization is used to represents bits for encryption.

Chapter 7: Cryptography - Public Key Infrastructure

I have found a website that explains PKI in a way that I understand a little better than the way the book puts it. Here is the link.

http://searchsecurity.techtarget.com/definition/PKI

Also, here is a diagram from the website that is helpful in describing whose key to use and what type of key to use.

To do this	Use whose	Kind of key
Send an encrypted message	Use the receiver's	Public key
Send an encrypted signature	Use the sender's	Private key
Decrypt an encrypted message	Use the receiver's	Private key
Decrypt an encrypted signature (and authenticate the sender)	Use the sender's	Public key

Below is another diagram that shows how PKI works in digital communication from http://www.asu.edu/ecure/2002/dollar/

Chapter 7: Cryptography - Message Integrity

One-Way Hash - Process that converts an amount of data and generates a fixed length value to protect integrity.

HMAC - Hashed message authentication code. Symmetric key concatenated with the message.

CBC-MAC - message gets encrypted with a symmetric block cipher.

CMAC - Cipher based message authentication code. Pretty much the same as CBC-MAC but a lot more secure mathematically.

I want to go ahead and point out the security services provided by each of these. A Hash function purely provides integrity. There is no confidentiality or authentication. Also, only unintentional modifications can be detected. HMAC lacks confidentiality, but it has integrity and data origin authentication. The same is true for CBC-MAC.