# Cyber Security Architecture

Primary Objective: Maintaining and conducting business operations in a secure environment.

* Organization: what are business needs
* Information: which are critical for business

&#x20;

Cyber Security Architecting:

* help you to translate organization's strategic requirements into actionable improvements in securing most valuable assets.

&#x20;

* Review and implement wide range of InfoSec paradigms
* including the foundations of risk management
* implementing processes and controls
* designing information systems securely
* managing the day-to-day activities required to ensure security is maintained in organization.

&#x20;

&#x20;

Security Model: CIA Triad

* Confidentiality
*
  * Which security control we in placed to achieve this
  *
    * Data encryption : data at rest
    * Hashing : data in transit (file integrity monitoring)
    *
      * Sha 256
      * Sha 512
    * MFA (IAM and user access)
    *
      * Privilege Access Management
      * Password rotations and policies
      * Secret Management
    * Physical Security
    * Default deny for critical data and infrastructure
    *
      * Documented approval from leadership
      * Proper auditing/activity log management
* Integrity
*
  * Encryption policies to achieve integrity when data at rest
  * Hashing policies to achieve integrity when data at transit
* Availability
*
  * High availability of services or access to data.
  *
    * What is org Disaster Recovery Plan?
    * What is org Business Continuity Plan?
    * Fail over clustering
    * Site reliability
    * Site resiliency
    * Automatic failover
    * Load balancing
    * Redundant components of software and hardware
    *
      * Cold, hot and warm sites

&#x20;

AAA

&#x20;

&#x20;

Cyber Security Framework : NIST

* What is our organization mission and vision
* what are security objectives and goals
* What are Critical Business Assets and Operations
* Inspire and  align with the security framework which closely tie with organization mission and objective

&#x20;

&#x20;

&#x20;

&#x20;

Keywords

* Risk
* Assets
* Threats
* Vulnerabilities
* Likelihood
* Impact
* Information security risk
* Security event
* Risk  scores
* Risk Assessment : to determine the impact of threat exploiting a vulnerability
* Risk Management : identify, evaluate, prioritize risks, developing mitigating controls, provide transparency and accountability

&#x20;

* Risk Appetite
* Risk Treatment
* Risk Acceptance
* Risk Transfer
* Risk reduction
* Risk Avoidance
* Residual risk

&#x20;

&#x20;

How many security events happened last year

How much risk associated with it

What is our organization risk score

Information security risk management vs cyber security risk management

&#x20;

&#x20;

&#x20;

Which asset inventory we are using

How accurate it is

How often it get updated

Asset

* Types of Assets
*
  * Physical
  * Digital
  * Non reputational assets
* Asset Owners
* Asset Classification
* Asset Name
* Asset IP range
* Asset Description
* Asset Notes

&#x20;

Asset Discovery

Asset Inventory

Asset Register

&#x20;

List to collect

* All windows servers managed by SCCM team
* All Linux Servers managed by SCCM team
* All windows desktops managed by SCCM team
* All Linux desktops managed by SCCM team
* Board approved software applications
* All Network Equipment
*
  * Routers
  * Switches
  * WAF
  * Load Balancers
  * Wi-Fi Assess points
  * Network Security control applications and solutions
* Domain Names
* IP ranges
* Virtual Instances
* Data backups
* Patch Management servers
* Active Directory
* Domain controllers
* DNS servers
* FTP servers
* Application servers
* Database servers
* Network Attached Storage

&#x20;

&#x20;

What are our Threats and Threat Actors

* Malicious outsiders
*
  * Script kiddies
  * Group actors
  * State sponsored actors
* Malicious insiders
* Accidental insiders
* Environmental threats

&#x20;

How to perform basic risk assessment to implement an Information Security Management System

How to mitigate the risks

&#x20;

What legal regulations Organization need to follow

How cyber security incident investigations run

How organization compliance structure

Which compliance management tool we are using

How to monitor compliance posture

What is our compliance landscape

What are the compliance requirements

What is our threat landscape

What is our compliance risk

What and which audit requirements need for organization

Which security questionnaires we follow and who are responsible

Do we manage/process

* Personally Identifiable Information (PII)
* Protected Health Information (PHI)

Which privacy regulations we need to follow

* GDPR
* COPPA
* HIPPA
* CCPA

&#x20;

Compliance

* PCI DSS
* SOX
* FISMA

&#x20;

&#x20;

Standards to follow

* ISO 27001
* ISO 27018

&#x20;

Information Security policies

Information security procedures

Information security playbooks

&#x20;

Maintain security awareness program

&#x20;

&#x20;

Managing threat party risks

Shared Responsibility Models

* Cloud Service Provider
* SaaS
* PaaS
* IaaS
* Source code repositories
* Accounting
* HR
* DLP
* SIEM

What are service level agreements

Vendor security assessment questionnaire

[https://opensource.google/projects/vsaq](https://opensource.google/projects/vsaq)

&#x20;

How we are implementing Defense in depth

How we are implementing Zero Trust

What's our risk management and governance approach

&#x20;

&#x20;

&#x20;

Information Security Policies Training at the time of onboarding

Social Engineering attacks training

* Do they properly advertising

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

&#x20;

On Boarding

* User account creation
* IAM policies review
* Level of Assess and permissions review
* Asset Allocation
* Badging permissions review
* Security Awareness Training
* CMDB : user and asset information
* How to block safeguard the asset if we lose it, Remote access of the asset in case of loss ?
* DLP Data Loss Prevention Policies ?
* Removeable media use case policies ?
