>> Hi, everybody. For all the security principles
in the CIA triad,
we have to remember some security concepts.
First of all, security through
>> obscurity is not security.
>> There's two schools of thought with software security.
There's open code,
so that folks can look at the code
>> and recommend changes.
>> For example, TCP/IP is an open protocol,
Unix and Linux are open operating systems,
or the alternative is to have closed
and proprietary code like Microsoft.
The thought with closed code,
if you can't see it, you can't break it.
But that is security through obscurity,
and it doesn't work. We prefer openness.
Another idea is security by design.
We design a product to be secure.
Instead of coming along later,
and realizing that something is not secure.
We start by thinking about security from
the very beginning in the design of our products.
We haven't always done this.
For example, IP, HTTP,
FTP, these are all protocols that are not secure.
They had to be made secure later,
after they were designed.
Then last but not least,
layered defense is a security concept.
Here, we make an attacker go through a series of
controls and you make those controls different.
If you think about physical security,
you don't just have multiple fences.
Instead you have fences,
but also security guards,
swipe card access, maybe biometric scans, etc.
You can apply the same principle for
securing our data and our systems.
That wraps up some of those principles
and basics of security.
Always go back to the CIA triad,
confidentiality, integrity, and availability.
Those are tenants of security
and we always want to protect them.
Watch for threats like social engineering.
Consider what happens to your data remnants.
With integrity, we think about
modifications so we use hashes or digital signatures.
Then when we think about availability,
we think about denial-of-service,
so we make sure we have redundancy in place.