01_introduction

• Information Security
• Tertiary Education

Information Security

What does cybersecurity primarily focus on?

1. Protecting networks and systems
2. User education and awareness
3. Data storage management
4. Maintaining physical security measures

Which is a key aspect of information security?

1. Network performance optimisation
2. Data confidentiality and integrity
3. Software development practices
4. User interface design

Cybersecurity is mainly concerned with which threat?

1. Employee misconduct
2. Natural disasters
3. Cyber attacks and breaches
4. Supply chain management

Information security ensures the protection of what?

1. Software applications
2. Physical office space
3. Employee productivity
4. Sensitive data and information

Cybersecurity vs Information Security

Information Security - covers all formats; Cybersecurity focuses on digital. 

CIA Triad

Confidentiality: Encryption, access control, social engineering awareness.

Integrity: Hashing, digital signatures, data validation.

Availability: Redundancy, fault tolerance, backup strategies.

Security Controls and Best Practices

Types: Administrative, Technical, Physical.

Control Types: Preventive, Detective, Corrective, Deterrent, Compensating.

Principles: Least privilege, separation of duties, defense-in-depth.

Security Controls and Best Practices

What is Security Framework? 

a structured set of guidelines, standards, and best practices that organizations use to:

Identify and manage security risks.

Protect critical information assets.

Ensure compliance with regulations.

Establish a strong security posture.

Why use security framework?

Why use Security Framework?

Provide consistent practices across systems and teams.

Ensure regulatory and industry compliance.

Support risk-based decision-making.

Promote continuous security improvement.

Security Frameworks Overview

ISO/IEC 27001

NIST SP800-53

COBIT

PCI-DSS

CIS Top 20

Discuss how frameworks support governance and compliance. 

What can you understand about Security Framework ISO/IEC 27001?

NIST SP 800-53

U.S.-based framework by the National Institute of Standards and Technology.

Provides a catalog of security and privacy controls.

Used heavily in government and federal systems.

Structured around the Risk Management Framework (RMF).

PCI-DSS (Payment Card Industry Data Security Standard)

Created by major credit card companies (Visa, MasterCard, etc.).

Applies to organizations handling cardholder data.

Focus areas:

Secure network and systems.

Protect cardholder data.

Vulnerability management.

Access control and monitoring.

COBIT (Control Objectives for Information and Related Technology)

Developed by ISACA.

Focuses on IT governance and management.

Aligns IT goals with business objectives.

Includes 4 domains: Plan, Build, Deliver, Monitor.

Risk Management Concepts

Define risk, threat, vulnerability, impact.

Introduce the risk formula:

Qualitative: Risk = Threat × Vulnerability.

Discuss exposure, countermeasures, and residual risk.

Risk Assessment and Mitigation Process

Steps in risk assessment:

1. Identify assets.

2. Identify threats and vulnerabilities.

3. Analyze risk.

4. Evaluate and prioritize.

Risk Responses: Accept, avoid, transfer, mitigate.

Information Security Governance and Leadership

Role of policies, leadership, and culture.

SOC (Security Operations Center) and incident response.

Cyber resilience planning and communication.