Security Policies, Threats, and
Risk Management
CET331
Lecture 1: Fundamental Security
Teaching and Learning Resources
▪ Whitman, M. E., & Mattord, H. J. (2009). Principles of information security (p. 656). Boston,
MA: Thomson Course Technology.
▪ Landoll, D. J. (2017). Information security policies, procedures, and standards: a
practitioner's reference. Auerbach Publications.
▪ CompTIA Security+ (SY0-701) Official Study Guide.
▪ Lecture slides and notes
▪ Topic-related videos and articles.
Student Assessment System
Item
Weight
Homework / Quizzes/attendance 30%
Mid-Term Exam
25%
Project
5%
Final Exam
40 %
Total
100 %
Subject to update according to SUT policies
Homework Assignments
● The homework assignments will usually consist of multiple-choice
questions (MCQs) and problems that relate to the lectures, course notes and
reading.
● Notes:
○ You should use tool in solving all homework programs
○ Each homework has a due date and time, and I will not accept any
homework after that date
○ Make sure your name and assignment number are on each page
Quizzes
▪ Two quizzes will be given throughout the semester.
▪ The quizzes will consist of
▪ very short answers or multiple-choice questions
▪ or small task relating to the same material as the homework.
▪ I especially use the quizzes to make sure students keep up with the course.
Lab work
▪ Involves implementation of studied techniques and structures.
▪ Each lab will comprise of a lab exercise to be submitted during the same lab
time.
▪ Lab assignments will also be given to be submitted individually.
Course Syllabus (lectures)
Page - 7
Week
Topics
Week 1
Overview of Security Concepts
Week 2
Threat Actors & Threat Vectors
Week 3
Cryptographic Solutions
Week 4
Implement Identity and Access Management
Week 5
Secure Enterprise Network Architecture
Course Syllabus (lectures)
Page - 8
Week
Topics
Week 6
Cloud Network Architecture
Week 7
Resiliency and Site Security Concepts
Week 8
Vulnerability & Risk Management
Week 9
Security Capabilities (Network, Endpoint,
Applications)
Week 10
Security Governance & Compliance
Intended Learning Outcomes (ILOs)
▪ This course aims to introduce students to the concept of:
➢ Explain core security principles, threat types, and risk management frameworks.
➢ Identify and classify common cyber threats, vulnerabilities, and attacks.
➢ Apply security controls, and policies to protect systems, and networks data.
➢ Analyze and evaluate risks using structured methodologies.
➢ Develop security policies that align with governance, and compliance requirements.
➢ Demonstrate skills in incident response, disaster recovery, and continuity planning.
➢ Prepare effectively for the CompTIA Security+ certification.
Lecture 1.
Agenda
Agenda
▪ Fundamentals of Security
▪ Accounting
▪ Threats and Vulnerabilities ▪ Security Control Categories
▪ Confidentiality
▪ Security Control Types
▪ Integrity
▪ Gap Analysis
▪ Availability
▪ Non-repudiation
▪ Authentication
▪ Authorization
Fundamentals of Security
● What is Information Security?
○
Protecting data and systems from unauthorized access, misuse, disclosure, disruption, or
destruction.
● Why Security Matters?
○
○
○
Growing dependence on digital systems.
Increasing cyberattacks and data breaches.
High impact on organizations, economies, and individuals.
● Key Security Goals:
○
○
○
Page - 12
Protect information assets.
Ensure trust in systems and services.
Support business continuity and compliance.
CIA Security Triads
Confidentiality
Integrity
Page - 13
Avalaibility
Confidentiality
●
●
●
●
Information is accessed by only those with the right permit
Prevents unauthorized disclosure of sensitive data.
Protects privacy and trade secrets.
Examples:
○
○
○
Page - 14
Encryption of files and communications.
Access control (usernames, passwords, biometrics).
Data classification and handling policies.
Integrity
●
●
●
●
Ensures information is accurate, consistent, and unaltered.
Prevents unauthorized modification, tampering, or corruption.
Builds trust in data reliability.
Examples:
○
○
Page - 15
Checksums and hashing (e.g., SHA-256).Digital signatures.
Version control and audit logs.
Availability
●
●
●
●
Ensures information and services are available when needed.
Protects against disruptions, downtime, and denial-of-service.
Supports business continuity.
Examples:
○
○
○
Page - 16
Redundancy and backups.
Disaster recovery planning.
Load balancing and DDoS protection.
DAD Triads
Source
Page - 17
Disclosure
●
●
●
●
Attackers aim to gain access to sensitive information.
Breaks confidentiality.
Can harm privacy, business reputation, or national security.
Examples:
○
○
○
Page - 18
Data breaches (leaked customer records).
Eavesdropping on network traffic.
Insider leaks.
Alteration
●
●
●
●
Attackers modify or tamper with data.
Breaks integrity.
Leads to false information, fraud, or loss of trust.
Examples:
○
○
○
Page - 19
Changing financial records.
Tampering with medical prescriptions.
Modifying system logs to hide evidence.
Denial
●
●
●
●
Attackers disrupt services or block legitimate access.
Breaks availability.
Causes downtime and financial loss.
Examples:
○
○
○
Page - 20
Distributed Denial of Service (DDoS) attacks.
Ransomware locking files.
Cutting network cables or destroying servers.
Threats and Vulnerabilities
Page - 21
Threats and Vulnerabilities
Page - 22
Security Attacks
Page - 23
Security Attacks
❑ An unauthorized party gains access to an asset.
■ Release of message contents.
■ Traffic analysis.
❑
Passive attacks are breaches of confidentiality (secrecy).
Security Attacks
Page - 25
Security Attacks (Cont.)
Active attacks
1. Interruption/denial of service
❑ An asset of the system is destroyed or becomes unavailable.
❑ This is an attack on availability.
2. Modification /replay/Masquerade
❑ An unauthorized party not only gains access to some portion of transmitted
messages but also alters or reorders those messages to produce an unauthorized effect.
3. Fabrication/Masquerade
❑ An unauthorized party inserts false object into the system.
❑ This is an attack on authenticity.
Page - 26
Active Attacks
❑
Page - 27
Active attacks affect the availability, integrity, and authentication of data.
Security Attacks
Interruption: This is an
attack on availability
Modification: This is an
attack on integrity
Interception: This is an
attack on confidentiality
Fabrication: This is an
attack on authenticity
28
Cybersecurity Framework
● The Nist Framework Has 5 Parts
○
○
○
○
○
Page - 29
Identify - Evaluate Risks, Threats & Vulnerabilities And Recommend Security Controls To
Mitigate Them.
Protect - Procure/Develop, Install, Operate And Decommission It Hardware & Software
Assets With Security As An Embedded Requirement At Every Stage.
Detect - Perform Ongoing Proactive Monitoring To Ensure That Security Controls Are
Effective And Capable Of Protection Against New Types Of Threats.
Respond - Identify, Analyze, Contain And Eradicate Threats To Systems And Data Security
Recover - Implement Cyber Security Resilience To Restore Systems And Data If Other
Controls Are Unable To Prevent Attacks
Non-repudiation
● Guarantees that a sender cannot deny sending a message or performing
an action.
● Ensures a receiver cannot deny receiving the message.
● Provides accountability and proof in digital communications.
● How It Is Achieved:
○
○
○
Digital Signatures – bind a message to the sender.
Public Key Infrastructure (PKI) – trusted certificate authorities verify identities.
Audit Logs & Timestamps – record actions for later verification.
● Examples:
○
○
○
Page - 30
A user cannot deny authorizing a bank transfer.
An employee cannot deny sending a signed email.
Legal documents signed digitally with certificates.
Authentication
●
●
●
●
Verifies who the user or system is.
First step before granting access.
Based on credentials or evidence of identity.
Common Methods:
○
○
○
Something you know – passwords, PINs.
Something you have – smart cards, tokens.
Something you are – biometrics (fingerprint, iris).Multi-factor authentication (MFA) for
stronger security.
● Example:
○
Page - 31
Logging into an online banking account with username + password + SMS code.
Authorization
●
●
●
●
Determines what an authenticated user is allowed to do.
Enforces least privilege principle.
Controlled through roles, permissions, and policies.
Examples:
○
○
○
Page - 32
A student can access their grades, but not the professor’s records.
An employee may view payroll system but cannot edit salaries.
Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC).
Accounting
●
●
●
●
Records and monitors user actions for accountability.
Provides evidence for audits, investigations, and compliance.
Helps detect suspicious or malicious activity.
Examples:
○
○
○
Page - 33
System logs recording login attempts.
Audit trails for financial transactions.
Monitoring data downloads to detect leaks.
Control Objectives
● Controls are tactics or strategies that proactively minimize risk by reducing
or eliminating:
○
○
○
Page - 34
A vulnerability
The likelihood that a threat actor will exploit a vulnerability
The impact of an exploit
Control objectives
● Controls can be measured by
○
○
○
○
Functionality - what the control does
Effectiveness - how well a control works (consistency, reliability, timely)
Assurance - a measure of confidence that intended security controls are effective in their
application
Cost-Benefit
● Control objectives refer to a statement of a desired result that should be
achieved by implementing a control or set of controls.
Page - 35
Defense-in-depth
● Design and implementation of multiple overlapping layers of diverse
controls.
● Controls should maintain independence and not be subject to the
cascading effect.
● Security Control Baselines
○
These express the minimum standards for a given environment
● Fine-Tuning Controls
○
○
○
○
Page - 36
Scoping - Eliminating unnecessary baseline recommendations that are not applicable
Tailoring - Customizing baseline recommendations to align with objectives
Compensating - Substituting a recommended baseline control with a similar control
Supplementing - Adding to the baseline recommendations
Agenda
Security Control Categories
▪ A security control Is something designed to give a system or digital asset the properties
of CIA & Non-Repudiation.
▪ There are three main Security Control categories:
▪ Technical - Implemented as a system such as firewalls, anti-malware and OS access
control. They can also be referred to as logical controls.
▪ Operational - Implemented primarily by people rather than systems
▪ Managerial - These controls give oversight of the information systems.
Security Control Functional Types
● Preventive
○
These controls act to eliminate or reduce the likelihood that an attack can succeed
● Detective
○
These controls may not deter access but will identify and record any attempted or successful intrusion.
● Corrective
○
These controls act to eliminate or reduce the impact of an intrusion event .
● Physical
○
These include alarms, security cameras and guards and can be used to deter physical access to premises
and hardware.
● Deterrent
○
These controls can psychologically discourage an attacker from attempting an intrusion.
● Compensating
○
Page - 38
These controls serve as a substitute for a principal control by a security standard and affords the same (or
better) level of protection but uses a different methodology or technology.
Agenda
Gap Analysis
•
•
•
•
Gap analysis is a process that identifies how an organization’s security
systems deviate from those required or recommended by a framework.
This will be performed when first adopting a framework or when meeting a
new industry or legal compliance requirement.
The analysis might be repeated every few years to meet compliance
requirements or to validate any changes.
For each section of the framework, a gap analysis report will provide an
overall score, a detailed list of missing or poorly configured controls
associated with that section, and recommendations for remediation.
Agenda
Gap Analysis
•
•
•
While some or all work involved in gap analysis could be performed by the
internal security team, a gap analysis is likely to involve third-party
consultants.
Frameworks and compliance requirements from regulations and legislation
can be complex enough to require a specialist.
Advice and feedback from an external party can alert the internal security
team to oversights and to new trends and changes in best practice.
Any Questions