CYS406 · Chapter 1 · Annotated SlidesNetwork Security Fundamentals
Original
Overview

Network Security Fundamentals

Threats, vulnerabilities, attacks and threat actors, attacker methodologies, the goals and principles of network defense (information assurance), defense approaches, administrative controls: regulatory frameworks, ISO standards, security policies and awareness training, then physical and technical controls.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 47 slides
  1. 1 C|ND
  2. 2 Module Objectives Network Security Attacks
  3. 3 Module Objectives Network Defenses
  4. 4 Module Flow
  5. 5 Essential terminologies related to Network Security
  6. 6 Definitions
  7. 7 Definitions
  8. 8 Types of Threat Actors
  9. 9 Types of Threat Actors
  10. 10 Causes of Vulnerabilities: - Hardware or Software Misconfiguration - Insecure or poor design of network - Inherent technology weaknesses - End-user carelessness
  11. 11 Definitions
  12. 12 Definitions
  13. 13 Slide 13
  14. 14 Slide 14
  15. 15 Slide 15
  16. 16 Slide 16
  17. 17 Slide 17
  18. 18 Slide 18
  19. 19 Examples of Wireless Network Specific Attack Techniques
  20. 20 Attacker Hacking Methodologies and Frameworks
  21. 21 Importance of Network Security
  22. 22 Goal of Network Defense
  23. 23 Information Assurance (IA) Principles
  24. 24 Information Assurance (IA) Principles (Cont’d)
  25. 25 Network Defense Benefits
  26. 26 Network Defense Challenges
  27. 27 Types of Network Defense Approaches
  28. 28 Network Security Controls: Administrative Security Controls
  29. 29 Regulatory Frameworks Compliance
  30. 30 Regulatory Frameworks Compliance (Cont’d)
  31. 31 Identifying Which Regulatory Framework to Comply
  32. 32 ISO Information Security Standards
  33. 33 What is Security Policy?
  34. 34 Key Elements of Security Policy
  35. 35 Contents of a Security Policy
  36. 36 Types of Information Security Policies
  37. 37 Internet Access Policies
  38. 38 Password Policy
  39. 39 Network Security Controls: Physical Security Controls
  40. 40 Employee Awareness and Training
  41. 41 Security policy training teaches employees how their duties and to comply with the
  42. 42 Employee Awareness and Training: Physical Security
  43. 43 Employee Awareness and Training: Social Engineering
  44. 44 Network Security Controls: Technical Security Controls
  45. 45 Module Flow
  46. 46 Network Security Protocols
  47. 47 Module Summary
Slide 1 / 47

C|ND

Slide 1: C|ND
Slide 2 / 47

Module Objectives Network Security Attacks

Slide 2: Module Objectives Network Security Attacks
Slide 3 / 47

Module Objectives Network Defenses

Slide 3: Module Objectives Network Defenses
Slide 4 / 47

Module Flow

Slide 4: Module Flow
Slide 5 / 47

Essential terminologies related to Network Security

Slide 5: Essential terminologies related to Network Security
Slide 6 / 47

Definitions

Slide 6: Definitions

Notes

  1. Threat: potential harm. Vulnerability: weakness. Attack: an attempt to exploit a vulnerability. Risk: threat × vulnerability × impact.

Slide 7 / 47

Definitions

Slide 7: Definitions
Slide 8 / 47

Types of Threat Actors

Slide 8: Types of Threat Actors

Notes

  1. Threat actors: script kiddies, hacktivists, organized crime, nation states, insiders, cyber terrorists.

Slide 9 / 47

Types of Threat Actors

Slide 9: Types of Threat Actors
Slide 10 / 47

Causes of Vulnerabilities: - Hardware or Software Misconfiguration - Insecure or poor design of network - Inherent technology weaknesses - End-user carelessness

Slide 10: Causes of Vulnerabilities: - Hardware or Software Misconfiguration - Insecure or poor design of network - Inherent technology weaknesses - End-user carelessness

Notes

  1. Vulnerabilities come from misconfiguration, design flaws, unpatched software, weak policies and human error.

Slide 11 / 47

Definitions

Slide 11: Definitions
Slide 12 / 47

Definitions

Slide 12: Definitions
Slide 13 / 47

Slide 13

Slide 13: Slide 13
Slide 14 / 47

Slide 14

Slide 14: Slide 14
Slide 15 / 47

Slide 15

Slide 15: Slide 15
Slide 16 / 47

Slide 16

Slide 16: Slide 16
Slide 17 / 47

Slide 17

Slide 17: Slide 17
Slide 18 / 47

Slide 18

Slide 18: Slide 18
Slide 19 / 47

Examples of Wireless Network Specific Attack Techniques

Slide 19: Examples of Wireless Network Specific Attack Techniques
Slide 20 / 47

Attacker Hacking Methodologies and Frameworks

Slide 20: Attacker Hacking Methodologies and Frameworks
Slide 21 / 47

Importance of Network Security

Slide 21: Importance of Network Security
Slide 22 / 47

Goal of Network Defense

Slide 22: Goal of Network Defense
Slide 23 / 47

Information Assurance (IA) Principles

Slide 23: Information Assurance (IA) Principles

Notes

  1. Information Assurance principles: confidentiality, integrity, availability, authentication, non-repudiation.

Exam angle

PredictionQ1

Proving a sender cannot deny having sent a message is:

Slide 24 / 47

Information Assurance (IA) Principles (Cont’d)

Slide 24: Information Assurance (IA) Principles (Cont’d)
Slide 25 / 47

Network Defense Benefits

Slide 25: Network Defense Benefits
Slide 26 / 47

Network Defense Challenges

Slide 26: Network Defense Challenges
Slide 27 / 47

Types of Network Defense Approaches

Slide 27: Types of Network Defense Approaches

Exam angle

PredictionQ1

Analysing past incidents to find what went wrong is which approach?

Slide 28 / 47

Network Security Controls: Administrative Security Controls

Slide 28: Network Security Controls: Administrative Security Controls

Notes

  1. Three control families: administrative (policies, training), physical (locks, guards), technical (firewalls, encryption, access control).

Slide 29 / 47

Regulatory Frameworks Compliance

Slide 29: Regulatory Frameworks Compliance

Notes

  1. Regulatory frameworks: PCI DSS (cards), HIPAA (health), SOX (finance), GDPR (EU personal data), ISO 27001.

Exam angle

PredictionQ1

Which standard governs organizations that process payment cards?

Slide 30 / 47

Regulatory Frameworks Compliance (Cont’d)

Slide 30: Regulatory Frameworks Compliance (Cont’d)
Slide 31 / 47

Identifying Which Regulatory Framework to Comply

Slide 31: Identifying Which Regulatory Framework to Comply
Slide 32 / 47

ISO Information Security Standards

Slide 32: ISO Information Security Standards
Slide 33 / 47

What is Security Policy?

Slide 33: What is Security Policy?

Notes

  1. Security policy: a document stating how the organization protects its assets; sets rules and responsibilities.

Slide 34 / 47

Key Elements of Security Policy

Slide 34: Key Elements of Security Policy
Slide 35 / 47

Contents of a Security Policy

Slide 35: Contents of a Security Policy
Slide 36 / 47

Types of Information Security Policies

Slide 36: Types of Information Security Policies

Notes

  1. Policy types by strictness: promiscuous (no restrictions), permissive (block known-bad), prudent (block most, allow needed), paranoid (block everything).

Exam angle

PredictionQ1

A policy that allows everything except known dangerous services is:

Slide 37 / 47

Internet Access Policies

Slide 37: Internet Access Policies
Slide 38 / 47

Password Policy

Slide 38: Password Policy

Notes

  1. Password policy: length, complexity, history, expiry, lockout.

Slide 39 / 47

Network Security Controls: Physical Security Controls

Slide 39: Network Security Controls: Physical Security Controls
Slide 40 / 47

Employee Awareness and Training

Slide 40: Employee Awareness and Training

Notes

  1. Awareness training reduces social engineering and policy violations: people are the weakest link.

Slide 41 / 47

Security policy training teaches employees how their duties and to comply with the

Slide 41: Security policy training teaches employees how their duties and to comply with the
Slide 42 / 47

Employee Awareness and Training: Physical Security

Slide 42: Employee Awareness and Training: Physical Security
Slide 43 / 47

Employee Awareness and Training: Social Engineering

Slide 43: Employee Awareness and Training: Social Engineering
Slide 44 / 47

Network Security Controls: Technical Security Controls

Slide 44: Network Security Controls: Technical Security Controls
Slide 45 / 47

Module Flow

Slide 45: Module Flow
Slide 46 / 47

Network Security Protocols

Slide 46: Network Security Protocols
Slide 47 / 47

Module Summary

Slide 47: Module Summary