This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Writing Security Policies | |
https://www.cyberpilot.io/it-security-policy-downloada | |
Purpose | |
- Provide a framework | |
- Sets objectives for IT Security | |
- Delegates responsibility | |
- Creates guidelines and rules for employees to follow | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Continuity of the Enterprise | |
- Get Sr Mgt buyin | |
- Build a Charter | |
Business Continuity | |
- Incorporates Info Systems AND everything else! | |
- In for the long haul | |
- Starts as incident/Ends as disaster | |
- Coordinated strategy involving plans, procedures, and technical measures | |
- Enable the recovery of info systems, operations and data after a disruption |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Incident Response | |
- Hands off! | |
- We dont act/we advise | |
Prepare | |
- Coordinate Planning and Design | |
- Identify Incident Management Requirements | |
- Obtain Funding and Sponsorship | |
- Develop Policies, Plans, Processes |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Designing Secure Systems | |
Authentication | |
- Scenarios to Protect | |
- User logins | |
- Employee access to internal systems | |
- Design Points | |
- String password policy | |
- Multi-factor authentication (MFA) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Essential Endpoint Best Practices | |
Regular Updates and Patching | |
- Ensure all devices and software are kept up to date on all patches and updates | |
- This practice fixes vulnerabilities that could be exploited by attackers and enhances the overall security posture | |
Strong Authentication and Access Control | |
- Implement strong password policies and multi-factor authentication (MFA) to reduce the risk of unauthorized access | |
- Apply the Principle Of Least Privilege (PLP) by restricting user access rights to only what is necessary for their role. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Role Based Access Control | |
- Has Role | |
- Has Permission | |
- User | |
- Role | |
- Permission | |
- User can have 1-n Roles (User-Role) | |
- Role can have 1-n Permissions (Rolex-Permission) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
https://insights.sei.cmu.edu/blog/uefi-terra-firma-for-attackers/ | |
Kernel Driver Failed | |
- Ring 0 | |
- Kernel Mode (OS Code) | |
- Can see all memory | |
- When kernel mode code crashes -> The System Crashes | |
- Blue Screens since alternative could be worse | |
- OS doesnt know what to do | |
- Application code is not separated from one another |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Risk Identification | |
- The first and most fundamental stage | |
Risk Analysis | |
- Follows Identification | |
- Structured process that involves identifying ways to achieve goals, anlyzing consequences and assessing the likelihood of hazardous events. | |
Risk Evaluation | |
- Follows Analysis | |
- Risks should be ranked and prioritized |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Infromation Security Program Global/Local Policies | |
Local Entity | |
- Must comply with local law for data collected in the country | |
- Sr Management is accountable for legal compliance | |
- Policy takes 2nd place to law | |
- Law supercedes internal policy | |
- Local regulations can differ from the country where the organization is HQ | |
- Not likely that org policy will cover all local legal requirements | |
- Local law supercedes law of country where HQ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Strategy Methodologies | |
Frameworks | |
- COBIT | |
- Framework | |
- IT Governance and Management | |
- CMMI | |
- Framework | |
- Process Improvement |
NewerOlder