Information Security & Management

The CIA Triad is a fundamental model in information security that emphasizes three core principles: Confidentiality ensures that sensitive information is accessible only to authorized users; Integrity guarantees that data remains accurate and unaltered during storage and transmission; Availability ensures that information and resources are accessible to authorized users when needed. Together, these principles form the foundation for securing data and systems, making them essential for protecting information in any organization.

In the Knight Capital incident, a software deployment error occurred when one of the eight servers was not updated correctly. This oversight led to a malfunction in the trading algorithm, causing erroneous trades that resulted in a massive financial loss of $460 million. The failure to ensure all servers were synchronized with the latest software highlights the critical importance of thorough testing and deployment processes in high-stakes trading environments, where even minor lapses can lead to catastrophic consequences.

Purchasing cyber insurance represents a transfer of risk because the organization is shifting the financial burden of potential data breaches to the insurance provider. Instead of bearing the costs directly, the organization pays a premium to the insurer, who will cover losses up to a certain limit. This strategy allows the organization to manage its exposure to financial loss while still maintaining its operations.

This scenario illustrates a processing control because it involves monitoring and managing the calculations that occur during payroll processing. By flagging any salary calculations that exceed a predefined threshold, the system ensures that potential errors or anomalies are identified and reviewed before finalizing payroll. This type of control helps maintain accuracy and integrity in the processing phase, ensuring that all calculations are valid and compliant with established guidelines.

In this scenario, the hacker has gained access to an employee's account by obtaining their login credentials through phishing. This indicates that the employee's account has been compromised, even though the employee may not have intended to cause harm. The hacker, acting as a compromised insider, exploits the legitimate access to sensitive systems, making this type of threat distinct from malicious or negligent insiders who act intentionally or through carelessness.

The principle of least privilege is a security concept aimed at minimizing potential risks associated with insider threats. By granting users only the minimum access rights necessary for their specific job functions, organizations reduce the chances of unauthorized access to sensitive information or systems. This approach limits the potential damage that could be caused by malicious insiders or accidental misuse, enhancing overall security while ensuring employees can still perform their duties effectively.

IT governance is concerned with establishing frameworks and policies that ensure IT aligns with and supports the overall business goals. It focuses on strategic oversight and accountability, ensuring that IT investments deliver value and mitigate risks. In contrast, IT management is primarily about the day-to-day operations, implementing the strategies and policies set by governance. This distinction highlights governance's role in directing IT's purpose and alignment with business objectives, while management executes the operational tasks necessary to achieve those goals.

In the PDC (Plan-Do-Check) framework for addressing security incidents, the order of controls is crucial for effective incident management. Firewalls serve as the first line of defense, blocking unauthorized access and threats. Once a potential incident occurs, audit logs provide critical insights and evidence for analysis, allowing for a thorough investigation. Finally, data backups are essential for recovery, ensuring that information can be restored if compromised. This sequence prioritizes prevention, detection, and recovery, aligning with best practices in incident response.