Information Security A-Z: Cyber Security Bootcamp

The section introduces information security fundamentals, covering information, data, asset, document, record, and specification, plus the CIA triad, authentication, non-repudiation, access control, vulnerability, and threats.

Define information as data with real-world importance, and explain its role in decision making, baselines, and solving problems, while highlighting how data analysis drives IT service management and IT security.

Explore what constitutes assets, including people, processes, software, and data, and learn how documents and records differ to strengthen information security across an organization.

Define the differences between documents, specifications, and records in information security, with practical examples like audit reports and management review minutes.

Define information security as a set of practices to protect data from unauthorized access or alterations during storage and transmission, focusing on the CIA triad of confidentiality, integrity, and availability.

The lecture outlines the six major elements of information security, including confidentiality, integrity, availability, non-repudiation, authentication, and access control, anchored in the CIA triad.

Explore the CIA triad—confidentiality, integrity, and availability—and understand how these core security properties ensure authorized access, accurate data, and on-demand usability.

Protect information from unauthorized access through authentication, access control, and security controls across all assets. Real-world examples, like WhatsApp, illustrate how public-private key exchanges secure confidential data.

Preserve integrity by ensuring data is accurate and complete, not modified except by authorized people, and protect it with encryption and hashing so the recipient receives exactly what was sent.

Explore availability in information security, including how data should be delivered, when, what kind, and to whom, while ensuring confidentiality, integrity, authentication, and access control in online transfers.

Understand authentication as the first pillar of the triple-a framework, proving user identity through single, two, or multi-factor methods like passwords, biometrics, OTPs, and keys; compare it with authorization.

Explore non-repudiation through emails and digital signatures using private and public keys, providing verifiable sender identity, tamper-evidence, and logs in IT infrastructure.

Identify vulnerabilities as design flaws, weaknesses, or implementation errors that allow unauthorized access. Use vulnerability assessment and testing to uncover misconfigurations, default passwords, cross-site scripting, and SQL injection before deployment.

Identify threats and measure vulnerabilities through security testing and evaluation in ICT systems. Explore penetration testing, including black, white, and gray box approaches, and verify findings to avoid false positives.

Identify threats as the cause of incidents that harm an organization's assets, information, people, or systems, including accidental, man-made, natural, cyber threats, technical failures, insider threats, functional errors, and misconfigurations.

Explain information security risk as the likelihood of threats exploiting vulnerabilities of information assets, with risk equals likelihood times consequence, and cover risk assessment, evaluation, treatment, residual risk, and acceptance.

Identify and implement security controls—technical, administrative, managerial, and legal—to modify risk and achieve objectives like secure operations of information processing facilities.

Explore how information security controls are classified into preventive, detective, and corrective types and how these controls interlink with real-world examples like antivirus, access control, and cryptography.

Explore the relationship between the CIA triad—confidentiality, integrity, availability—and threat, risk, and vulnerability, illustrated by a diagram, while noting how controls and vulnerabilities link to information security management system concepts.

Explore the definition of information security management systems, the process approach, the PDCA cycle, risk assessment, internal audits, and the statement of applicability.

Describe information security management systems as a framework of policies and controls that establish, operate, monitor, and improve security to protect information assets and support business objectives.

Explore the pdca cycle steps for information security management systems, including plan, do, check, and act, covering risk assessment, scope, policies, controls, documentation, communication, audits, and continual improvement.

Learn how information security risk assessment identifies asset value, threats, vulnerabilities, and controls within an ISMS, prioritizes risks, and compares methods like Octave, Cram, and tra.

Identify assets, threats, controls, vulnerabilities, and consequences to support risk identification and evaluation, understanding how losses may occur and their impact on assets and business.

Assess consequences with business impact values, account for qualitative and quantitative analysis, evaluate incident likelihood, and determine risk levels using a risk matrix to guide risk evaluation and acceptance criteria.

Explore how to identify, evaluate, and treat information security risks by selecting cost-aware controls and choosing retention, avoidance, or sharing strategies while ensuring compliance.

Identify inherent risk, apply risk treatment, and recognize that residual risk remains after controls. Monitor residual risk against acceptance criteria and surveillance mechanisms, escalating unresolved risk to upper management.

Internal audits provide systematic, planned evaluations of it, infrastructure, policies, and operations to assess security controls and compliance with standards within the ISMS framework.

Identify and document nonconformities, then analyze root causes to determine corrective actions that prevent recurrence. Implement selected solutions, follow up, and review effectiveness to ensure ongoing security objectives.

Explore ISO/IEC 27001 security controls and objectives, detailing the 114 controls across 14 domains within an information security management system, guided by the PDCA cycle, risk assessment, and audits.

Explore information security risk management, including the risk formula, threat actors, PDCA cycle, risk assessment steps, NIST risk management framework, quantitative risk, loss expectancy, and people risks.

Explain risk as the probability of a threat actor exploiting a vulnerability in an IT system asset, and how risk management identifies and categorizes risk by severity, occurrence, and impact.

Identify how threat actors—from hackers and hacktivists to insiders, competitors, script kiddies, nation-states, and advanced persistent threats—exhibit malicious intent and threaten assets and operations.

Explore how probability, threats, vulnerabilities, and assets shape risk, and how the risk matrix uses probability and impact to assess cybersecurity risk.

Explore basic risk management fundamentals by defining infrastructure and organization, outlining security controls, and examining standards, laws, regulations, and risk frameworks like the NIST RMF.

Explore the Deming pdca cycle: plan, do, check, act, and its use in information security management systems to plan, implement, monitor, and continually improve security controls.

Risk assessment values information assets, identifies critical assets, and surfaces weaknesses in existing controls, guiding prioritization with a severity matrix and the implementation of new security controls.

Identify assets first, then assess vulnerabilities and threats to those assets, evaluate security controls, and apply the PDCA cycle with ISO 27001 to guide risk identification.

Analyze risks by identifying consequences and likelihoods, determine risk levels, and plan mitigation or transfer strategies for effective risk assessment.

Define security controls and NIST RMF, outlining steps to categorize, select, implement, verify, authorize, and monitor; compare laws, standards, best practices, and security policies such as acceptable use.

Explore the organization of information security controls by examining phase controls—deterrent, preventive, detective, and corrective—before, during, and after an attack, plus the three types: physical, administrative, and technical.

Apply defense in depth, vendor diversity, and user training to build layered security that mitigates threats, reduces single points of failure, and addresses insider risks.

Identify and analyze risk, apply risk treatment options such as mitigation, transference, sharing, and avoidance, and understand the residual risk that remains after addressing the inherent risk.

Explore the six-step NIST risk management framework, from categorizing information systems to monitoring controls, and learn how RMF enables risk-based decision making for federal information systems.

Learn to quantify risk in monetary terms using asset value, exposure factor, likelihood, and impact. Compare repair versus replacement costs and understand single loss expectancy and annual loss expectancy.

Compute single loss expectancy and annual loss expectancy by applying the exposure factor to the asset value and multiplying by the annualized rate of occurrence, with practical examples.

Learn to respond to risk through mitigation, transfer, acceptance, or avoidance, applying security controls and ongoing monitoring to keep risk at an acceptable level.

Organize data by evaluating databases, spreadsheets, and access control lists; assign sensitivity labels such as confidential, private, public, internal, sensitive, or government, and apply appropriate security controls accordingly.

Organize data by defining roles such as data owner, custodian, and steward, and assign a privacy officer to ensure CIA triad security, HIPAA and PCI DSS compliance.

Learn how to mitigate personnel-related information security risks across hiring, onboarding, training, and offboarding with policies and controls, including background checks, NDA, mandatory vacations, separation of duties, and multi-person control.

Explore types of agreements in information security, including sales and purchase agreements, service level agreements, MOUs, and interconnection security agreements, and their role in data protection and defining terms.

Define security and explain why cyber security matters in a digital world, highlighting privacy protection, data security, and key types such as network, information, application security, plus disaster recovery.

Define cyber security and explain standard definitions from NIST and government sources, then explore confidentiality, integrity, and availability and eye-opening security facts.

Trace the history of cybersecurity from the 1988 Morris worm to 1990s viruses, antivirus growth, endpoint protection, and the rise of hacker groups such as Anonymous.

Explore the scope of cybersecurity, career paths, and salary growth while learning core skills—from data in transit to data at rest and across industries.

Explore key cybersecurity terms such as threat, attack, vulnerability, event, risk, incident, alert, and asset, and explain how these concepts guide daily security operations.

Identify the five actor types in cyber security: hackers, cyber terrorists, hacktivists, state-sponsored actors, and script kiddies. Explain their methods, motivations, and social engineering risks.

Identify passive attacks as a core cybersecurity risk where an intruder monitors network traffic and conducts traffic analysis. Use secure channels to prevent information disclosure and privacy invasion.

Learn how active attacks modify data streams and disrupt operations, including masquerade, replay, and denial of service, with practical Bob, Alice, and Trudy scenarios and motives like theft and ransom.

Explore leading security organizations such as women in cyber security, the SANS Institute, OWASP, ISSA, and FIRST, and examine how their training, certifications, and communities advance skills and diversity.

Explore how security architects blend hardware and software knowledge with programming proficiency, research skills, and policy development to preempt threats, assess systems, and oversee budgets and security teams.

Explore the five main security attack categories—operating system, misconfiguration, application level, shrink wrap code, and scripting—and how unpatched systems, default passwords, and SQL injection enable breaches.

Learn how security services protect data and systems using confidentiality, integrity, and availability, along with non-repudiation and access control. Explore security mechanisms like cryptography, digital signatures, and security audits.

Explore an overview of cryptography, its purpose, and core concepts such as symmetric encryption, RSA, Diffie-Hellman, hashing, public key infrastructure, digital signatures, and TLS.

Explore the fundamentals of cryptography, its history from ancient ciphers to modern encryption, and how it safeguards confidentiality, integrity, and availability of information.

Explore cryptography by comparing symmetric encryption, which uses a single key to encrypt and decrypt cipher text, with asymmetric encryption using public and private keys.

Explore how classical substitution ciphers evolve into modern encryption, including Caesar cipher basics, transposition, stream and block ciphers, and the roles of public and private keys in symmetric encryption.

Describe how symmetric encryption uses a single private key to encrypt and decrypt data with a mathematical algorithm, highlighting speed and the Diffie-Hellman key exchange solution for sharing keys.

Explore symmetric encryption examples such as Twofish, DES, AES, and RC4. Note block and key sizes, AES 128/192/256-bit keys, and the single-key drawback solved by Diffie-Hellman.

Explore asymmetric encryption, where a public key locks and a private key unlocks messages, with examples like RSA, Diffie-Hellman, and ElGamal, and learn why two-key schemes differ from symmetric encryption.

Show how asymmetric encryption uses a recipient’s public key to encrypt and the private key to decrypt, enabling secure document transfer between Bob and Alice.

Diffie-Hellman enables two parties to establish a shared secret key over a public channel using a generator and prime, while private keys remain confidential, allowing subsequent symmetric encryption.

Explore hashing, a cryptographic process that transforms data into a unique message digest using md5, sha-1, sha-2, sha-3, and ripemd, to verify integrity.

Explore online hashing with md5 and sha-256, observe fixed hash length and sensitivity to input changes, and complete a practical hashing lab before upcoming topics like digital signatures and TLS/SSL.

Digital signatures provide authentication and verify that the sender agrees with the document, enabling secure transmission through PKI and trusted certificate authorities, via private keys, public keys, and hashing.

Digital signatures use sha-256 hashing and a private key to sign a document, and the recipient verifies with the public key.

Explore how secure sockets layer and tls establish a secure connection using rsa public key encryption, certificates, and a tls handshake between client and server.

Explore how a certificate authority verifies identities, handles public keys, and issues digital certificates to enable trusted authentication, digital signatures, and a hierarchical trust model.

Explore practical encryption and decryption using the advanced encryption package to encrypt files and disks, protect data with passwords, and securely retrieve original content.

This lecture introduces identity and access management, covering authentication, authorization, and accounting (AAA), authentication factors, access control models and mechanisms, and user and password management.

Explore what authentication means, how it verifies a user’s identity, and how authentication factors enable single, two, or multi-factor access within the triple A framework of authentication, authorization, and accounting.

Learn about authentication factors, including something you know, something you have, something you are, and somewhere you are, with examples like passwords, biometrics, IDs, and VPN-based access.

Explore how authorization determines what authenticated users can access and do with resources, enforcing permissions and distinguishing it from authentication by clarifying what rights you have.

Explore accounting, the third pillar of the Triple A, which monitors user activity, generates audit logs, and helps detect insider threats and unusual network access.

Explore the four major authentication systems: single factor, two factor, multi factor, and centralized authentication. Learn how they validate identity using factors like passwords, biometrics, and one-time passwords.

Explore mandatory access control, where the operating system grants access by data confidentiality and user clearance, with administrators configuring policies and security attributes to protect the CIA.

Discretionary access control lets data owners define permissions using access control lists, enforced by administrators, offering flexibility yet lower data protection.

Explore access control mechanisms, including username and password, time-based one-time passwords, biometric authentication, and smart cards, to validate identity and boost security in applications.

Enforce password management with a minimum length of seven characters and include special characters. Avoid using the username in passwords, maintain a password history, and change passwords periodically.

Examine practical access management through point-to-point authentication protocols, comparing Pap and Chap, where the client proves identity by hashing the password with a server challenge.

Learn how application programming interfaces enable cross-app communication and why API security matters, with core protections like authentication, authorization, encryption, access control, and monitoring and logging.

Learn why API security matters as the glue connecting systems in daily life, protecting against injection attacks, cross-site scripting, and man-in-the-middle attacks to prevent data breaches and downtime.

Explore api vulnerabilities such as injection attacks, broken authentication and session management, cross-site scripting, improper error handling, and insecure direct object references.

Design robust APIs by prioritizing consistency, simplicity, flexibility, and security from the start. Use clear endpoint names, proper HTTP verbs, versioning, and thorough documentation.

Explore how API frameworks, OAuth 2.0, and OpenID Connect secure your APIs, control third-party access, and verify user identities with ID tokens.

Explore who must comply with PCI DSS, why it is a standard not a law, and how cardholder data like PAN and expiration date drives secure networks and third-party validation.

Explore the history of PCI DSS, from its 2004 inception to the 2019 version 3.02.1, and how tokenization, multi-factor authentication, and service providers protect cardholder data.

Learn how qualified security assessors, authorized by the PCI security standards council, validate PCI DSS compliance. Discover how to choose an on-site, guidance-focused QC and verify qualifications.

PCI DSS helps manage identity theft and credit card fraud by enforcing security controls, reducing data breach risk, and protecting cardholder data, boosting customer confidence and protecting brand reputation.