- Welcome to Lesson 2:
Summarize Fundamental Security Concepts.
This is such an interesting lesson,
because there are five sub-lessons
that all focus on these very fundamental security concepts.
Some like, what we're going to talk about
in this Lesson 2.1: Security and Privacy Principles,
are tried and true,
and some like what we're gonna do next
in the next lesson, Zero Trust,
is really emerging,
but regardless of the age of the principle or the concept,
they're ones that are really fundamental and foundational
to how we design and support and implement
and manage and monitor
our information security or cybersecurity programs.
So let's start in with 2.1, Security and Privacy Principles.
Now, I bet this looks familiar.
This is our information security CIA triad.
This picture's been around
for really as long as I can remember.
It's the three components
of an information security program,
confidentiality, integrity, and availability,
often referred to
as our absolutely fundamental principles,
that the majority of the decisions
you will make in information security
are going to be tied
to confidentiality, integrity, or availability.
Now, I'm often asked, okay, but which is more important?
And my answer always is, well, it depends.
What's it depend on?
It depends on the strategic needs of your organization.
For some organizations, confidentiality is paramount.
For others, it may be integrity.
For others, it may be availability.
For others, it may vary by business unit, right?
For others, they all may be equal.
So you really need to get to know
what is it that your organization needs
when we're applying these fundamental principles.
So let's define them, starting with confidentiality.
Confidentiality is assurance
that information is not disclosed
to unauthorized, persons, processes, or devices.
Confidentiality is going to cover data in all its states,
in storage, during processing, and in transit.
You know, confidentiality really is a principle
that most of us learned in kindergarten, right?
When somebody told us a secret,
we knew that we weren't supposed to share that secret
with anyone else, unless they were authorized.
So confidentiality.
Next up is integrity.
Integrity is the principle that systems are trustworthy,
and that they work as intended,
and that the data is complete and accurate.
So what we're doing here
is we're protecting from advertent or inadvertent,
malicious or non-malicious, or accidental changes,
and really to focus on that we can trust our systems,
that our systems are trustworthy, they work as intended,
and the data is complete and accurate.
And our third principle is availability,
availability being the principle that information systems
as well as the supporting infrastructures
are operating and accessible when needed.
Confidentiality, integrity, and availability.
Now, there are four supporting principles
that I wanna share with you as well.
Authentication.
Authentication is the process of verifying identity, right?
We wanna make sure we know who you are.
Authorization is the process of approving access.
Accounting is the process
of tracing actions to their source, who did what.
And lastly, non-repudiation is the process
of assuring the validity and the origin of data.
And in subsequent lessons,
we're gonna dive deep into authentication, authorization,
accounting, and non-repudiation principles.
So this has been our tried and true triad forever now
in information cybersecurity.
But I wanna add another triangle.
Now, I know it's not a triad anymore,
and I don't know what this new shape would really be called,
but I think that every cybersecurity practitioner
really, really needs to take to heart and understand
privacy principles,
that we can no longer say, "Oh, privacy.
That belongs to another department.
Oh, that's part of legal, or that's part of compliance."
Privacy is an absolutely critical component
of the decisions that we make, the actions that we take
in information security or cybersecurity.
So I want us to pause here,
moving a little bit away from our CIA,
and talk about, okay, so what is privacy,
and how does privacy differ from confidentiality?
Privacy succinctly is the right of an individual
to control the use of their personal information.
Now, more and more, consumers, end users
expect their privacy to be respected
and their personal information to be protected
by the organizations with which they do business.
And I would say the same is true internally, right?
Employees expect their privacy to be respected,
stakeholders expect their privacy to be respected
and any personal information that is collected
should be protected by the organizations
with which they do business.
And data privacy controls relate to actions
regarding what data we're gonna collect, how we're using it,
how do we notify someone what we're doing with their data,
how do we ensure that it's kept accurate and up to date?
And how do we make decisions
about who it's going to be shared with?
Now, that's really different, right,
than the protection mechanisms that we're putting in place
of confidentiality, integrity, and availability.
Because when we apply those principles,
generally, we are applying those fundamental principles
to data that is already in our possession,
and we're not making any decisions about,
well, should we have it?
Should we not have it?
Should we have collected it?
How are we using it, right?
All of that happens separately.
It all happens in the privacy realm, right?
Our data security controls say we wanna make sure
that we are protecting
the confidentiality, integrity, and availability.
So let's take a closer look at those privacy principles.
I wanna share with you
four of the eight OECD Privacy Principles.
You can learn more about the OECD organization at oecd.org.
There are actually eight Privacy Principles,
but we're gonna focus in on the first four,
and I do wanna mention that the majority
of the privacy regulations around the world,
like GDPR, the General Data Protection Regulation,
its foundation is in these OECD privacy principles.
So the first is collection limitation,
and that says a collection of personal data
should be obtained by fair and lawful means,
and where appropriate,
with the knowledge and the consent of the data subject.
The second is data quality,
and that's a personal data should be relevant
to the purpose collected
and should be accurate, kept up to date, and be complete.
Purpose specification
is that the purpose for which data is going to be collected
should be specified
not later than at the time of collection.
So you can't say,
"Oh, I'm gonna collect a bunch of this stuff,
'cause I bet it would be useful later on."
You have to have a purpose right from the very beginning.
And then the use limitation
says personal data should not be disclosed
or otherwise used for purposes other than specified,
so specified in that purpose specification,
except with the consent of the data subject
and/or by the authority of law.
Now, whether we're talking about
the fundamental cybersecurity principles
of confidentiality, integrity, or availability,
or these privacy principles,
I always want you to keep in mind
is that every security and privacy objective
must be strategically aligned
with the needs of the organization.
And our mission, you and I, as security practitioners,
is really to integrate those fundamental principles,
confidentiality, integrity, availability, and privacy
into business processes
in support of organizational objectives.
And that, my friends, brings us to a three-second challenge.
You know how to do this.
Five questions, three seconds each.
Get ready to shout 'em out.
Principle that focuses on protection
from unintentional, accidental, or inadvertent change.
One, two, three.
Integrity.
Question two, the right of an individual
to control the use of their personal information.
Shout it right out.
One, two, three.
That's privacy.
Question three, principle that information is not disclosed
to unauthorized persons, processes, or devices.
One, two, three.
Confidentiality.
Number four, principle that information systems
and supporting infrastructure
are operating and accessible when needed.
One, two, three.
That's availability.
And here's our last one.
The process of tracing actions to their source.
I didn't spend a lot of time on this one.
One, two, three.
And that is accounting.
And we'll be talking more
about accounting and accountability in subsequent lessons.
So that brings us to
our third security-in-action case study.
Remember, the reason we're doing these
is so you can practically apply
the knowledge that you've learned in this lesson.
So we're gonna read the case study together,
I'm gonna ask you a question,
then it'll be a great time to put me on pause
while you work through the answer,
and then you'll come on back
and we'll go through it together.
You're leading a discussion about internal security.
You launch with defining the fundamental principles
of confidentiality, integrity, availability, and privacy.
But as discussion unfolds,
you realize there's a lot of confusion
about how privacy fits in.
"After all," one participant asks,
"isn't that the same as confidentiality?"
So how do you respond?
Go ahead and put me on pause while you jot down an answer.
Come on back when you're ready.
Well, your response might be
that privacy and confidentiality
are different yet complimentary principles.
Data privacy relates to actions regarding purpose,
lawful collection, accuracy, usage, notification,
and sharing of data,
where confidentiality focuses on
protecting the data in our possession
from unauthorized access or disclosure.
So being able to clarify,
to be able to lead others through this discussion,
that my friends, is definitely security-in-action.
All right, there's your word cloud.
You know what to do.
You're gonna look through every one of these terms.
You're not gonna move on until you are sure
that you can describe what each one of these means.
When you're ready, head on over to Lesson 2.2,
and I'll be waiting for you right there.