Module 9.1- Basic Security Concepts & Strategies

Question 1

CIA Triad

Answer 1

• Confidentiality- keeping sensitive information hidden from those why shouldn’t have access
• Integrity- ensures information remains accurate and unaltered
• Availability- ensures information and systems are accessible when needed
• together these three principles work hand in hand to provide a strong foundation for information security

Question 2

Frameworks that help guide in creating Secure Systems

Answer 2

• NIST (National Institute of Standards and Technology)- think of NIST as a detailed guidebook for security
• provides a framework that helps organisations manage and reduce cybersecurity risks
• it’s like a step-by-step process for making sure your security practices are solid
• ISO/LEC- an international standard; if NIST is the guidebook, ISO/IEC is the globally recognised manual that organisations around the world follow to keep their data secure
• ensures that everyone is on the same page when it comes to best practices

Question 3

Building a Strong Defence (Defence in Depth)

Answer 3

• all about creating multiple layers of protection, so even if one layer is breached, the others can still hold strong
• first, you might start with a firewall as the outer layer, blocking unwanted traffic
• next, you add encryption to protect sensitive data from prying eyes
• then, you require MFA, making sure that even if someone gets through, they need more than just a password to access your systems

Question 4

Securing Devices: Mobile, Workstations, and loT

Answer 4

• whether you’re dealing with smartphones, workstations, or those smart devices we love, like smart fridges or thermostats, everything that connects to the internet needs to be protected

Question 5

Mobile Devices

Answer 5

• most important thing? Keep them updated! Those software updates you get? They often contain important security patches
• don’t forget to use strong passcodes and biometric authentication like fingerprints or face scans- it’s your first line of defence

Question 6

Workstations

Answer 6

• when it comes to workstations, security means installing antivirus software, enabling firewalls, and controlling who has access
• you also want to limit what can be plugged into the machine- USB drives can be a sneaky way to introduce malware

Question 7

IoT Devices

Answer 7

(smart light bulbs, thermostats, even your fridge)
- they’re all connected, and that means they need protection too

• always change the default passwords on these devices, and if possible, put them on a separate network from your primary devices to reduce risk if one of them gets compromised

Question 8

Authentication (Proving Who You Are)

Answer 8

• this is where MFA comes in- it’s no longer just about passwords
• first, there’s something you know- like a password or PIN
• next, there’s something you have- like a phone or security token that generates a one-time code
• finally, there’s something you are- biometrics like a fingerprint or facial recognition
• by combining these factors, you create an extra layer of security that makes it much harder for attackers to get through- even if someone steals your password, they’d still need that second factor to break in

Question 9

Authorisation: Deciding Who gets Access

Answer 9

• once you’ve authenticated someone, the next step is figuring out what they’re allowed to do; this is called authorisation- it’s about assigning roles and permissions to control who can access what
• regular users might only have access to certain files or systems
• admins, on the other hand, can modify or delete files, create new users, and control the overall system settings
• by carefully managing these roles, you reduce the risk of accidental or intentional misuse of important information

Question 10

Password Best Practices

Answer 10

• strong passwords are still one of the best ways to protect your accounts

1. make sure your password is at least 12 characters long- the longer, the better
2. use a mix of uppercase and lowercase letters, numbers, and symbols- avoid obvious things like your pet’s name or “password123.”
3. consider using a password manager to keep track of everything- a lot easier than trying to remember dozens of unique passwords, and it ensures that you’re using strong, random combinations for each account