Cybersecurity

Transcript of the free preview lesson. Remaining lessons unlock with the full course.

So here we are talking about cybersecurity. And when you think about cybersecurity, what comes to mind? You're really talking about security of data that is electronic in nature, and when you talk about security for data that is electronic in nature, quite a few things come to mind. First of all, this INFOSEC realm right over here that discusses the confidentiality, integrity, availability, or the CIA triad, if you will, that is part of INFOSEC. However, when you're dealing with information assurance, when you extend that, you also deal with authentication and non-repudiation. And what does that really mean? Well, here's the thing. There's a few misunderstandings about the way this goes, and I want to clarify those things. The confidentiality piece means not only that you are protecting the data, but you're also training and making people aware of what to protect. Sometimes it's very obvious; other times it's not. So confidentiality surrounds and information security and cybersecurity surrounds a lot of components and a lot of pieces of the puzzle. And here, if you will, as you see, that it incorporates protection, detection, and reaction capabilities of information systems. You need to know what to protect, how to detect when there's something going wrong, and what actions to take in order to, well, correct what has gone wrong. Confidentiality, that approach, if you will, thinking about making sure that things are protected, you're talking about from the outside layer in. So from the outside, people enter your network, and then your machines, and then your applications, and then they get to the data. Maintaining the integrity of the data is a very key piece of the puzzle, and making sure that the data's available only to those that are allowed to have it is also very important. Making certain that people are who they say they are. Authenticating that they are who they say they are is a very important piece of the equation. As well as when people do things that they cannot deny that they did them. If John manages to send an email, non-repudiation piece, would be able to prove that John's the one that sent that email from that workstation, at this time, from this source. And the system would authenticate that John is who he says he is. So this CIA, confidentiality, integrity, and availability, very big piece, and then authentication and non-repudiation is added to the information assurance. So what is information assurance? I'm kind of working backward, aren't I? These are measures, measures that protect and defend information, data and information systems, the data that is driven by those systems, by ensuring that availability, integrity, authentication, confidentiality, and non-repudiation is done. This also includes, this information assurance piece, includes providing the restoration of information systems. This is a pretty big piece of the equation. You may have heard of Rule of Nine as it relates to high availability. Restoration of information. Rule of Nine says do you want the system to be up 90% of the time, 99% of the time? 90% of the time is one nine. 99% of the time is two nines. 99.9% of the time is three nines. 99.99% of the time is four nines, and so on. Most critical systems have to follow some kind of a Rule of Nines or high availability. That's this aspect right over here. Data has to be proven that it is viable and correct. Integrity of the data is very critical. You cannot say that the address on the system that we have for you is not correct. The purchase orders that we have on the system belong to the wrong customer. That is not maintaining the integrity of the data. If you cannot rely on the integrity of the data, the whole system is really in jeopardy, is it not? So otherwise, if your protecting data that it, well, that the integrity's not protected on, you're protecting garbage. What's the use of protecting or making sure that confidentiality's maintained on the data that doesn't really have any kind of integrity associated with it? Availability is that Rule of Nines that I was talking about. Authentication is managed in many different ways. Authentication, trying to prove you are, is also done by bio-metric, by your fingerprints, by your retina scan, by your facial recognition, and so on, along with user ID and password, which is the way it's done in many places. So keep that in mind as far as information systems and cybersecurity goes.