Cybersecurity Principles, Practices & Processes

The cybersecurity cube has three dimensions. Any security question can be placed on it: which goal is at stake, which state is the data in, and which countermeasure addresses it.

The CIA triad is the three foundational principles of security. It lets a security expert prioritise actions when protecting a networked system.

Confidentiality

Prevents disclosure of information to unauthorised people, resources or processes.

Integrity

The accuracy, consistency and trustworthiness of data.

Availability

Information is accessible to authorised users when it is needed.

Tokenization gives confidentiality without encryption. A random value with no mathematical relationship to the original replaces the data, and it isolates data elements from exposure to other data systems. Outside the system the token is meaningless. It can keep the data's type and length, which suits databases and card payment processing.

Rights management covers DRM and IRM. Both protect data from unauthorised access using encryption.

Sensitive information falls into three categories.

Personal

Anything traceable to an individual: medical records, credit card numbers, social security numbers.

Business

Anything that is a risk if the public or a competitor sees it: acquisition plans, customer information, trade secrets.

Classified

Belongs to a government body or similar: secret, confidential or restricted access.

Privacy enhancement technologies are anonymization, data minimization and tokenization. Data anonymization obscures private data stored in a clear format and turns it into irreversible anonymous information. Privacy laws control the appropriate use of data and access to data, and they protect you from an organisation that might want to share your sensitive data.

Data integrity is the accuracy, consistency and trustworthiness of data across its entire lifecycle. Data goes through capture, storage, retrieval, update and transfer, and it must stay unaltered by unauthorised entities in all of them. Losing integrity can make a whole data resource unreliable or unusable.

• —Hashing
• —Data validation checks
• —Data consistency checks
• —Access controls

A data integrity system can use one or more of these methods. How much integrity matters depends on how the organisation uses its data: a bank rates it higher than a social media channel.

Availability is keeping information accessible whenever it is needed. Cyberattacks and system failures can block access. DoS attacks threaten availability by stopping legitimate users from using information systems.

High availability uses system redundancy, system backups, increased system resiliency, equipment maintenance, OS and software updates and patches, and proactive plans for swift recovery from disasters.

Data at rest is data in storage: no user or process is accessing, requesting or amending it. It can sit on a local device or be centralised on a network. Backup data also counts when it is not being written or in transit. Anything that is neither in transit nor in process is at rest.

• —DAS is one of the hardest storage types to manage and control, and it is exposed to attacks on the local host. Limit the types of data kept on it.
• —Network storage (RAID, SAN, NAS) gives more performance and redundancy, but it is more complex to configure and manage. It also holds more data, so a device failure puts more at risk. The challenges are configuring, testing and monitoring.
• —NAS and SAN hold data in the stored state.

Data in transit is data being transmitted: not at rest and not in use. Protecting it is one of the hardest jobs of a security professional.

Both wired and wireless networks send packets: units of data travelling from a source to a destination. IP and HTTP define packet structure and format, and those standards are open and public.

Data in process is data during initial input, modification, computation or output: the state it is in when it is neither in transit nor at rest.

Data corruption is modification that makes data unreadable or unusable. If accounting files are corrupted with no manual error or failure point, suspect malicious code. Protecting data in process needs well-designed systems and policies on testing, maintenance and updates.

Technology safeguards are software-based or hardware-based. Software safeguards protect operating systems, databases and services on workstations, portable devices and servers.

Technology alone fails if people are untrained. A security awareness program should be part of onboarding, tied to job requirements or performance evaluations, and delivered through in-person sessions (using gamification and activities) and online modules. It is ongoing, because new threats keep appearing.

A security policy sets security objectives, rules of behaviour and system requirements. A comprehensive policy:

• —demonstrates the organisation's commitment to security
• —sets the rules for expected behaviour
• —ensures consistency in system operations and in hardware and software acquisition, use and maintenance
• —defines the legal consequences of violations
• —gives security staff the backing of management

Outside guidelines come from the NIST Computer Security Resource Center, the NSA Security Configuration Guides and the Common Criteria standard.