AAA
Authentication Authorization Accounting
who can access a system, what they can do, and what they did.
Authentication: Verified identity. Username + password, PIN, Smart card etc
Authorization: Once authenticated, the system decides your permissions.
Admin vs standard user. Access to certain folders, databases, or systems
Accounting: This is logging and auditing user activity.
Login/logout times. Files accessed
CIA
Confidentiality Integrity Availability
Confidentiality: ensures information is not disclosed to unauthorized users.
Integrity: ensures data is accurate and unaltered.
Availability: ensures systems and data are accessible to authorized users.
BIA
identifies what is critical to the business and what happens if it stops working.
Business Impact Analysis
identifies what is critical to the business and what happens if it stops working.
DLP
set of tools and policies designed to prevent sensitive data from leaving the organization unintentionally or without authorization.
Data Loss Prevention
IR
is the structured process an organization uses to detect, respond to, contain, and recover from security incidents such as malware infections, data breaches, or unauthorized access.
The goal of incident response is to minimize damage, reduce recovery time, and prevent future incidents.
Incident Response
SIEM
is a centralized system that collects, correlates, analyzes, and alerts on security events from across an organization’s IT environment.
Security Information and Event Management
SOC
is a centralized team and facility responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents 24/7.
Security Operations Center
CSIRT
is a group of people responsible for responding to and managing security incidents once they are detected.
If the SOC detects, the CSIRT responds.
Computer Security Incident Response Team
MTTR
is a metric that measures the average time it takes to resolve an incident or restore a system after a failure.
Mean Time To Recover
Mean Time to Repair – How long it takes to fix a system
Mean Time to Respond – How long it takes to begin responding to an incident
Mean Time to Recover – How long it takes to return to normal operations
MTBF
is a reliability metric that measures the average amount of time a system operates normally before it fails.
Mean Time Between Failures
