Information Assurance & Cyber Security Fundamentals

Defense-in-Depth is a cybersecurity strategy that employs multiple layers of security measures to protect information and systems. By implementing various controls—such as firewalls, intrusion detection systems, and access controls—organizations create a robust defense. If one layer is compromised, the attacker must overcome additional barriers, reducing the likelihood of a successful breach. This layered approach enhances overall security resilience by ensuring that even if one defense fails, others remain in place to mitigate risks and protect critical assets.

A Man-in-the-Middle (MitM) attack occurs when an attacker intercepts and potentially alters communication between two parties without their knowledge. This type of attack primarily exploits vulnerabilities in network protocols and channels, making it a network-based threat. By positioning themselves in the communication path, attackers can eavesdrop, steal sensitive information, or inject malicious content, which aligns with the characteristics of network attacks rather than social engineering, application, or physical attacks.

Application-layer attacks target vulnerabilities in software applications, exploiting weaknesses in their code. SQL Injection (SQLi) involves manipulating queries to access unauthorized data, while Cross-Site Scripting (XSS) injects malicious scripts into web pages viewed by users. Buffer Overflow attacks exploit flaws in memory handling, allowing attackers to execute arbitrary code. In contrast, Distributed Denial of Service (DDoS) primarily targets network resources by overwhelming them with traffic, making it a network-layer attack rather than an application-layer attack. Thus, SQLi, XSS, and Buffer Overflow are classified as application-layer attacks.

Phishing is a cyber attack that involves sending deceptive emails to trick users into revealing sensitive information, such as usernames and passwords. These emails often appear to come from legitimate sources, making it easy for unsuspecting individuals to fall victim. By clicking on malicious links or providing information on fake websites, users inadvertently expose their credentials to attackers, leading to potential identity theft or unauthorized access to accounts. This method relies heavily on social engineering to exploit human psychology rather than technical vulnerabilities.

Ransomware attacks often involve encrypting a victim's files and demanding payment for their release. Cybercriminals prefer cryptocurrency as the payment method because it allows for anonymity and is difficult to trace. This makes it harder for law enforcement to track the perpetrators and recover funds. Additionally, cryptocurrencies facilitate quick and borderless transactions, making them an attractive option for those looking to evade detection while profiting from their illicit activities.

A worm is a type of malware that can self-replicate and spread across networks independently, without needing any user intervention. Unlike viruses, which attach themselves to files and require a host to propagate, worms exploit vulnerabilities in network protocols or software to replicate and infect other systems. This ability allows worms to rapidly spread and can lead to significant network congestion and security breaches, making them particularly dangerous in a connected environment.

Information Assurance (IA) primarily emphasizes the protection of information systems through a comprehensive approach that includes managing operational risks, establishing strategic governance frameworks, and ensuring compliance with legal and regulatory requirements. While technical defenses and malware detection are important, IA focuses on the broader context of safeguarding information assets by aligning security practices with business objectives and legal standards, thereby maintaining the integrity, confidentiality, and availability of information. This holistic view ensures that organizations not only implement security measures but also understand the implications of their information management strategies.

In information security, 'Risk' encompasses both the likelihood of a threat exploiting a vulnerability and the resulting impact on the business. This definition highlights that risk is not just about the existence of vulnerabilities but also involves assessing how likely it is that these vulnerabilities will be exploited and what the consequences would be if they were. This comprehensive understanding helps organizations prioritize their security measures and allocate resources effectively to mitigate potential threats.

A vulnerability refers to a specific weakness in a system, whether in its design, software code, or operational procedures, that can be targeted by attackers. These flaws can allow unauthorized access, data breaches, or other malicious activities, making it crucial for organizations to identify and address vulnerabilities to enhance security. By understanding and mitigating these weaknesses, organizations can protect their assets and maintain the integrity of their systems.

ISO/IEC 27001 is recognized internationally as the standard for creating, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a systematic approach to managing sensitive company information, ensuring its confidentiality, integrity, and availability. By adhering to this standard, organizations can effectively manage risks related to information security, comply with legal and regulatory requirements, and demonstrate their commitment to protecting data, thereby gaining stakeholder trust.

The Electronic Commerce Act of 2000 (RA 8792) was enacted to promote and facilitate electronic transactions in the Philippines. It establishes the legal standing of electronic documents and digital signatures, ensuring that they are treated equally to their traditional paper counterparts. This recognition is crucial for fostering trust in online transactions, allowing businesses and individuals to engage in commerce electronically with legal assurance. By validating electronic communications, the Act supports the growth of e-commerce and digital innovation in the country.

RA 10175, or the Cybercrime Prevention Act of 2012, addresses a broad range of cybercrimes to enhance legal frameworks protecting against digital offenses. It specifically criminalizes illegal access to computer systems, data interference, cyber fraud, and cyber libel, reflecting the need to combat various malicious activities in the digital space. This comprehensive approach aims to safeguard individuals and organizations from the increasing threats posed by cybercriminals, ensuring accountability and promoting safe online environments.

RA 10173, also known as the Data Privacy Act of 2012, mandates that any personal data breach that poses a risk to the rights and freedoms of individuals must be reported to the National Privacy Commission within 72 hours. This law aims to protect the privacy of individuals and ensure that organizations handle personal data responsibly. The timely notification requirement is crucial for mitigating potential harm and maintaining public trust in data management practices.

Republic Act 10173, enacted in 2012, is known as the Data Privacy Act of 2012 in the Philippines. This law aims to protect the privacy of individuals by regulating the collection, handling, and processing of personal information in both public and private sectors. It establishes guidelines for data subjects' rights, data controllers' responsibilities, and the establishment of the National Privacy Commission to oversee compliance and enforcement of data privacy standards, ensuring that individuals' personal information is safeguarded against misuse and breaches.

Accountability refers to the ability to trace actions back to a specific individual or system process, ensuring that users are responsible for their actions within a system. This tenet is crucial in security frameworks as it helps in monitoring and auditing activities, making it possible to identify who performed what actions. By establishing accountability, organizations can deter malicious behavior and ensure compliance with policies, as individuals know they can be held responsible for their actions.

Non-repudiation is a security principle that ensures that once a transaction or action is performed, the parties involved cannot deny their involvement. This is achieved through the use of digital signatures, which authenticate the identity of the sender, and audit logs, which provide a record of all transactions. These mechanisms create a reliable trail of evidence that can be used to verify actions, thus preventing any party from disputing their participation in the transaction.

Integrity ensures that data remains accurate, complete, and uncorrupted by protecting it from unauthorized modification and ensuring that any changes made can be tracked and verified. This pillar of the CIA Triad emphasizes the importance of maintaining the authenticity of information, allowing users to trust that the data they are accessing is reliable and has not been tampered with. By implementing measures such as checksums, encryption, and access controls, organizations can uphold data integrity and prevent errors or malicious alterations.

Confidentiality in the CIA Triad focuses on protecting sensitive information from unauthorized access. It ensures that only individuals who have been granted specific permissions—referred to as authorized individuals—can view or handle this information. This principle is crucial for maintaining privacy and security, preventing data breaches, and ensuring that sensitive data is only accessible to those who need it for legitimate purposes. By restricting access to authorized personnel, organizations can safeguard their information assets against potential threats.

The CIA Triad consists of three core principles: Confidentiality, Integrity, and Availability. These principles are essential for ensuring the security and protection of information. Authenticity, while important in cybersecurity, is not one of the primary pillars of the Triad. Instead, it relates to verifying the identity of users and the integrity of data but does not directly address the core aspects of information security represented by the CIA Triad.

Information Security (InfoSec) primarily aims to protect an organization's information assets from unauthorized access, disclosure, alteration, and destruction. This involves implementing technical defenses such as firewalls, intrusion detection systems, and encryption, which are essential for preventing threats. Additionally, access controls ensure that only authorized personnel can access sensitive data, thereby mitigating risks associated with data breaches. By emphasizing these technical measures, InfoSec plays a crucial role in safeguarding the integrity, confidentiality, and availability of information within an organization.