Welcome to Security Operations for the Certified in Cybersecurity examination.
Let's take a look at data security.
This area of the exam is worth 18%, but we could say this area is important.
It's kind of the capstone of everything we've done so far because
it's in operations where we're actually carrying out all of the good
things we talked about in governance, risk,
access control, networks, and so on.
We divided this area into three main sections,
data security, security operations and administration,
and security awareness training.
At the end of this chapter,
we will take a little look at exam review tips and
techniques we can use as well.
Let's start with a look at data security because protecting data,
we know, is one of the most valuable assets of the organization.
Data protection requires that we know who owns or,
we could say, is responsible for the data.
And that, ultimately,
should be a very senior manager who is able to accept
responsibility on behalf of the organization.
But everybody who accesses our data is responsible
for what they do with it as well.
We need to make sure that we have communicated that with them.
And one of the ways we communicate that with them is through classification.
We indicate what the classification of the data is,
and each classification level, whether or not it's business private,
business confidential, secret, whatever classification labels we use,
each one of those should have its own handling requirements so we know
how to handle the data with that classification.
We put labels on so people can clearly see and know what level
of protection the data should be provided.
We also have to have a retention policy.
Now there's two factors that come in here.
Number 1,
we should obviously keep the data as long as we need it for business purposes.
But number 2,
we often have to keep data for a certain length of
time because of legal reasons.
We are required by law to keep it for 10 years or whatever it happens to be.
So obviously, our policy on data retention should consider both of those factors.
When we keep the data for an extended period of time,
we have to make sure it's then kept in a way that we can
retrieve it when we need to as well.
But when we reach end of life,
that's where we want to make sure we have the proper level
of destruction for the data as well.
Now, in many cases, this will be secure destruction with things like shredding,
for example, destroying the actual equipment that the data was on,
and making sure that was actually done,
not that we employed somebody to get rid of old equipment
and turns out they were reselling it.
We've had that happen in a number of cases actually.
So, secure destruction means it's auditable,
and we validated that that data cannot be recovered.
It was destroyed properly.
One of the things that scares many people is cryptography,
but don't be afraid of it.
Cryptography is really just logical.
We'll take a few minutes here to look at it,
and maybe you'll want to even listen or watch this a few more times.
That's great.
But it really is just a logical sequence.
The hardest thing is the terminology.
Now, why do we have that here?
Because this is one of the main ways we protect our data.
So let's say we have a person who has a message.
We'll call the message M.
And that message in its normal format is what we would call plaintextx,
or you could call it clear text.
Anybody could read it.
But we want to protect this data.
We want to protect this message,
whether or not it's a file or an email or even a communication,
for example.
So what we do is we feed it into a crypto system.
A crypto system is basically just some type of process that will
perform something that we call encryption.
Now we could also use terms like to encipher the data or to encode the data.
Very often, we just use the term encryption.
There is a difference between these three,
but it doesn't really matter in this case.
The whole point is within the crypto system is a little
mathematical operation known as an algorithm,
and that algorithm will then convert that plaintextx into unreadable text.
It does this under the control of a key.
Now, the key, just like a password, is also sometimes known as a crypto variable.
It's the key you chose to lock your data.
And when I mix together the plaintext and the key using this crypto system,
I generate cipher text of that message.
We'll call that CT for cipher text ‑ M of the message itself.
You'll also sometimes hear this called a cryptogram.
For some reason, in this world of cryptography,
they like to use two terms for everything.
We can now take that cipher text, and we know that it's secure.
Unauthorized people wouldn't be able to read it because
they wouldn't have the key to unlock it.
We could store it, for example, on a hard drive.
Or we could transmit it through an insecure channel, such as the internet.
And when we transmit this cipher text through that channel,
there could always be someone who's sniffing and watching the traffic.
But even if they captured that traffic going by,
it would be unreadable to them because they don't have the key.
The person who is intended to be able to read it will receive
this cipher text and feed it into that same type of crypto system
where we'll do the inverse operation.
We will decrypt, decipher, or decode the message.
But in order to do that, we need the correct key.
If I have the wrong key,
I'll just get garbage But if the person has the correct key,
they will be able to decrypt and get the message itself.
So this is how cryptography works.
As we said,
it's mostly just a logical process and just understanding the terminology.
We have, within the crypto systems, two main types of algorithms,
symmetric algorithms and asymmetric algorithms.
Let's look first of all that symmetric algorithms.
A symmetric algorithm is one that uses the same key in both
the encryption and decryption process.
So, in that case, if Alice is going to send a message to Bob,
she also has to make sure the key gets to Bob because he needs that same
type of a key in order to be able to decrypt the message.
The characteristics of symmetric are, first, it's good for confidentiality.
It does a very good job of protecting our data from being compromised.
It's relatively fast, especially when we compare it to its,
should we say, other type of algorithm, asymmetric.
And therefore, it's good for encrypting things like streaming content.
You take, for example,
wireless communications are encrypted usually using
some type of symmetric algorithm, if you're watching a video that's encrypted,
these sorts of things, or encrypted voice over IP communications.
Now, the thing about, of course, symmetric algorithms is that they are free.
They're freely available.
And we all pretty much use the same algorithms because it wouldn't
help if you used a different one than I did,
and we couldn't understand each other's messages.
The beginning of symmetric happened thousands of years ago.
But when we came to the area of technology,
then we saw the development of the Data Encryption Standard,
DES.
And it was the standard for use in the US Federal Government.
And it served for many years from the mid‑70s up until the late
'90s as the standard for data encryption.
But it began to lose its effectiveness.
Computational power increased,
and it was getting to the point of being possible to
break a DES‑encrypted message.
One of the solutions for that was triple DES.
Well, encrypt it three times with different keys,
and that would make it quite a bit stronger,
but also quite a bit slower.
And so there was a program to develop a new encryption standard for the US
Federal Government called the Advanced Encryption Standard,
and there are a number of different algorithms that were proposed for this.
And the algorithm that actually won that was Rijndael.
Rijndael was found to be very fast.
In fact, of the five finalists, it scored first in every category,
a product out of Belgium actually.
The other competitors for that were MARS from IBM,
SERPENT, a UK‑Israeli project, RC 4, 5, 6.
Now RC 6 was the competitor, Rivest cipher,
which is part of the RSA family, and, of course,
Blowfish from Bruce Schneier.
These are all very good symmetric algorithms,
and they're all free to use, which gives,
of course,
a tremendous advantage that we can all use them without having to worry
about all sorts of patents and license fees and so on.
Then came the world of asymmetric.
This was developed back in the mid‑70s actually,
and it's based on the use of a key pair.
You could choose a private key, your own private,
should we say here, password if you want to call it that.
Then, the point, of course, with this, as with any password,
is it must be kept secret.
You don't share that with anybody.
But,
what you could do is run your private key through a mathematical
process and generate from that a public key.
That basically meant it was derived from the private key
using what we called a one‑way function.
It's very easy to go from the private to the public,
but it's computational infeasible to go from the public back to the private.
And the idea of the public key is that you could
share that with absolutely anyone.
It was linked to the private key.
But because it was a one‑way function, yeah,
you could share it freely, and these keys would only work as a pair.
This private key would only work with that public key,
and that public key would only work with that corresponding private key.
That's an important part of all of this.
So, there were three basic asymmetric algorithms we use,
Diffie‑Hellman, with Diffie, of course,
one of the people that helped develop this,
Marty Hellman.
And then the combination from RSA, Rivest Shamir Adelman.
And Elliptic Curve Cryptography,
a product partially out of BlackBerry University of
Waterloo out of Denmark and so on.
And these are pretty much the three major ones we've used to date.
If I'm going to encrypt a message using asymmetric,
or we often call it public key crypto,
I can send a confidential message by taking that message,
say, from Alice,
putting it into a crypto system that now has an
asymmetric mathematical formula in it,
and encrypting it using the public key of Bob.
That creates cipher text of that message I can send
through that insecure channel.
When that is received,
Bob needs to put it through the same crypto system
using the same asymmetric algorithm.
But the only key that would work with this would be Bob's private key,
which Bob never shares with anybody.
And therefore,
anybody who encrypts a message with Bob's public key can only
be opened by Bob using his private key, and now he has the message.
So you can say, well, how does Alice get Bob's public key?
Usually this is done through something we call a certificate.
Bob has a certificate that's generated that says this public key belongs to Bob.
So we have an attestation or confidence of that.
When that certificate is shared with Alice,
Alice can extract that public key that she then used to encrypt the message.
So this is how simple it all works.
It's kind of a, should we say, logical process.
And, if necessary, it can be good to just go over this again.