WEBVTT 00:00.510 --> 00:05.930 How do we know what security controls to assign to an asset to protect it. 00:06.210 --> 00:09.210 Well you should know the answer to this as discussed. 00:09.210 --> 00:17.130 We do a risk assessment considering the threats or abilities and consequences to the assets and select 00:17.190 --> 00:19.170 appropriate security controls. 00:19.170 --> 00:27.240 But what exactly do our assets need from our security controls the security controls need to enable 00:27.480 --> 00:31.510 what we will call security attributes. 00:31.610 --> 00:37.260 We need to consider the type of security control we might need for an asset is to think about the asset 00:37.710 --> 00:40.030 in terms of its needs. 00:40.050 --> 00:46.200 For confidentiality integrity and availability. 00:46.200 --> 00:48.080 So let's define those three things. 00:48.080 --> 00:54.950 Now confidentiality do we not want the asset disclosed to anyone. 00:55.190 --> 01:03.000 I say that the asset is not disclosed to own authorized individuals entities and processes. 01:03.000 --> 01:12.080 If that is true that the asset that defines the sort of security controls we need for that asset. 01:12.090 --> 01:13.140 The next one. 01:13.140 --> 01:18.310 Integrity do we not want the asset on intentionally altered. 01:18.310 --> 01:26.430 Do we want to maintain and assure the accuracy and completeness of the asset over its entire lifecycle. 01:26.430 --> 01:32.920 This means that the asset cannot be modified and authorized or undetermined manner. 01:33.150 --> 01:41.100 Determining the security controls the last one availability do we not want it destroyed i.e. for any 01:41.100 --> 01:42.590 asset to serve its purpose. 01:42.600 --> 01:45.210 It must be available when it is needed. 01:45.210 --> 01:51.820 This means the systems used to store and process the asset the security controls used to protect it. 01:51.930 --> 01:56.850 The communication channels used to access it must be functioning correctly. 01:56.880 --> 02:01.780 Again this is determining the types of security controls. 02:01.830 --> 02:10.290 If that is a security attribute that the asset requires CIA it is known in the security industry as 02:10.290 --> 02:10.830 the. 02:11.020 --> 02:12.530 A triad. 02:12.600 --> 02:17.660 Its a very old but still well used security paradigm. 02:17.760 --> 02:22.130 And we can call these CIA these confidentiality integrity available. 02:22.180 --> 02:31.500 They can call each of those security attributes all the security properties that an asset needs to be 02:31.500 --> 02:34.350 secure as the security expert. 02:34.590 --> 02:43.380 You need to help determine what the assets are and assign what security attributes that are required 02:43.440 --> 02:48.900 for the asset so that it can be secured to within acceptable levels of risk. 02:48.960 --> 02:55.770 You would do this by questioning the owner of the entity that you are trying to secure and find out 02:55.770 --> 02:57.110 what they require. 02:57.120 --> 03:00.300 What does security mean to the owner. 03:00.360 --> 03:06.270 Thats why somebody can't say to you give me a secure system because you don't know what secure means 03:06.600 --> 03:13.800 you have to ask them what secure means and what method one technique is to use security attributes and 03:13.800 --> 03:17.250 find out what attributes those assets need. 03:17.250 --> 03:19.130 Does it need see. 03:19.210 --> 03:20.080 Or a. 03:20.190 --> 03:25.310 So you do a requirements gathering for the security needs or attributes of assets. 03:25.320 --> 03:27.560 You simply ask the owner what they want. 03:27.570 --> 03:32.640 This isn't always a simple process because you have to guide them with your expertise and they tell 03:32.640 --> 03:35.590 you what security means to them for that asset. 03:35.880 --> 03:44.600 Many security attributes have been proposed over time see a being the original and well referenced but 03:44.640 --> 03:45.760 it has its problems. 03:45.780 --> 03:53.460 The CIA doesn't cover all security needs and it does not speak in the language of the business or the 03:53.460 --> 03:55.620 way business people like to talk. 03:55.620 --> 04:01.710 So in 1998 a guy called Don park proposed an alternative model to the CIA triad. 04:01.720 --> 04:09.620 They called the six atomic elements of information all the park here and hexane the security attributes 04:09.650 --> 04:11.050 are confidentiality. 04:11.070 --> 04:17.010 As we've already known possession which is the new want integrity authenticity you know the new OWN 04:17.010 --> 04:23.800 availability and utility and the new arm of the new ones from the CIA. 04:23.850 --> 04:29.150 We have the first one possession or control is it can be called Let's define these. 04:29.220 --> 04:38.430 This would be a loss of control or possession of an asset but does not involve the breach of confidentiality. 04:38.430 --> 04:47.190 You've also got authenticity which refers to the veracity of the claim of origin or authorship of the 04:47.190 --> 04:48.050 asset. 04:48.360 --> 04:53.670 And then you have utility which means usefulness which again isn't part of CIA. 04:53.670 --> 05:03.330 So for example ransom where bankruptcy uses data the asset then is no longer useful it has no utility. 05:03.480 --> 05:10.050 So if you are just using the CIA as security attributes you would not have usefulness as an option but 05:10.050 --> 05:13.130 you would have available you which is similar. 05:13.350 --> 05:18.740 So these security attributes can be used to define asset security controls. 05:18.750 --> 05:24.870 As we said not in the park area and aid is non repudiation. 05:24.960 --> 05:30.780 And no the common security attribute we will see you mentioned if you read security literature. 05:30.990 --> 05:40.850 So no repudiation in the law implies Warnes intention to fulfill obligations to a contract in cybersecurity. 05:40.890 --> 05:47.430 It implies that one party of a transaction cannot deny having received a transaction or message. 05:47.430 --> 05:53.820 Nor can the other party deny having sent a transaction or message a non repudiation and shows that the 05:53.820 --> 05:57.420 sender can't deny sending the message. 05:57.570 --> 06:01.010 And there's also two other important and well referenced security and abuse. 06:01.030 --> 06:10.400 And those are authentication and authorization authentication verifies the identity of the user or system. 06:10.440 --> 06:12.270 Is it what it claims to be. 06:12.270 --> 06:14.990 Are you who you claim to be is the answer. 06:15.120 --> 06:16.460 What it claims to be. 06:16.590 --> 06:25.440 And then you have authorization so upon authentication of the identity or of an identity authorization 06:25.440 --> 06:28.860 determines what is it allowed to access. 06:28.920 --> 06:30.430 So authorization. 06:30.450 --> 06:37.140 What is it allowed to access authentication verifies the identity of the user or system. 06:37.140 --> 06:39.080 Is it what it claims to be. 06:39.120 --> 06:44.760 So as you can see there are many security attributes that we might want to assign to an asset or think 06:44.760 --> 06:48.520 about in terms of an asset in terms of security controls. 06:48.520 --> 06:54.310 And from these this enables us to choose security controls that provide those attributes. 06:54.480 --> 06:57.860 Let's get a little bit more tangible here with some examples. 06:57.930 --> 07:06.120 So if something is encrypted this can provide confidentiality if something is hashed this can provide 07:06.180 --> 07:09.840 integrity if something is digitally signed. 07:09.840 --> 07:17.790 This can also provide authentication on repudiation and integrity is something is encrypted and digitally 07:17.790 --> 07:18.490 signed. 07:18.540 --> 07:25.380 This can also provide confidentiality authentication non repudiation and integrity. 07:25.530 --> 07:30.480 So you can see that how we've gone from an asset to an obvious could attribute to then having security 07:30.480 --> 07:37.470 controls encryption and hashing and digital signatures then meet those security attributes that where 07:37.470 --> 07:42.750 if you didn't understand about what hashes or encryption all those things were going to go through as 07:42.750 --> 07:43.700 we go through the course. 07:43.710 --> 07:48.360 But it's just to show you the path through which we have our asset. 07:48.390 --> 07:53.690 We have our security attributes and then we have our security control that meets our security needs 07:53.690 --> 07:55.200 our security attributes. 07:55.320 --> 08:02.280 So as you can see the way we're talking we're not really talking in the way a business owner or a business 08:02.280 --> 08:04.100 person likes to speak. 08:04.170 --> 08:09.970 And it's often a business that is the entity by which we're trying to secure in cybersecurity. 08:09.970 --> 08:17.190 So this brings to light to use for designing security architectures that businesses and that's the ceps 08:17.640 --> 08:19.590 business attributes. 08:19.590 --> 08:20.620 And here we are. 08:20.760 --> 08:25.210 If we look here we can see security attributes or as they call them business attributes. 08:25.380 --> 08:31.170 But these speak a little better to the business to understand the security requirements i.e. security 08:31.170 --> 08:38.120 controls for assets you determine if these business attributes here are acquired. 08:38.250 --> 08:40.110 Maybe they're not required are they. 08:40.120 --> 08:46.680 Nice to have your assets you would look at their use of attribute management attribute operational attributes 08:47.030 --> 08:50.660 do you need detectability that need to be error free. 08:50.730 --> 08:54.910 Or disability should it be legal will it be scalable. 08:54.930 --> 08:57.580 Should it be governable and so on. 08:57.600 --> 09:00.360 So that's confidentiality integrity and availability. 09:00.570 --> 09:04.440 And I'm taking you a little bit further than what you might yet understand a security course where they 09:04.440 --> 09:06.480 may just talk about the CIA. 09:06.510 --> 09:11.230 I want to give you a little bit more of the real world where you need some more than the CIA through 09:11.270 --> 09:16.730 to the parking area and heck sayd through to even having business attributes that come from sabse. 09:16.870 --> 09:20.140 If you're interested more in sabzi and check out that link there.