Cyber security Management II - Tactical - C795 SOBs

Cyber security Management II - Tactical - C795 SOBs

• subjects are granted only the privileges necessary to per-

form assigned work tasks and no more. Keep in mind that privilege in this context includes both permissions to data and rights to perform tasks on

systems.: The principle of least privilege states that

• ensures that no single person has total control over a

critical function or system. This is necessary to ensure that no single

person can compromise the system or its security.: Separation of duties

and respon- sibilities

• is similar in concept to separation of duties and responsibil-

ities. A separation-of-privilege policy requires the use of granular rights

and permissions.: Separation of privilege

• is known as management of changes made to the

system's hardware, software, or firmware throughout its operational life

cycle.: Con- figuration management

• ............ they run as guest operating systems on physical

servers. The physical servers include extra processing power, memory,

and disk storage to handle the VM requirements.: 1. Virtual Machines

(VMs):

• is sometimes called a virtual desktop environment (VDE),

hosts a user's desktop as a VM on a server. Users can connect to the server to access their desktop from almost any system, including from mobile devices. Persistent virtual desktops retain a custom desktop for the user. Nonpersistent virtual desktops are identical for all users. If a user makes changes, the desktop reverts to a known state after the user logs off.: 1. Virtual Desktop Infrastructure (VDI): 1 / 4

• .....they decouple the control plane from the data plane

(or forwarding plane). The control plane uses protocols to decide where to send traffic, and the data plane includes rules that decide whether traffic will be forwarded. Instead of traditional networking equipment such as routers and switches, an SDN controller handles traffic routing using simpler network devices that accept instructions from the controller. This eliminates some of the complexity related to traditional networking protocols.: 1. Software-De- fined Networks (SDNs):

• A SAN is a dedicated high-speed network that hosts

multi- ple storage devices. They are often used with servers that need high-speed access to data. These have historically been expensive due to the complex hardware requirements of the SAN. VSANs bypass these

complexities with virtualization.: 1. Virtual Storage Area Networks

(VSANs): 2 / 4

• models provide fully functional applications typically

accessible via a web browser. For example, Google's Gmail is a SaaS appli- cation. The CSP (Google in this example) is responsible for all maintenance of the SaaS services. Consumers do not manage or control any of the cloud-based assets.: 1. Software as a service (SaaS): Software as a service (SaaS)

• models provide consumers with a computing plat-

form, including hardware, an operating system, and applications. In some cases, consumers install the applications from a list of choices provided by the CSP. Consumers manage their applications and possibly some configu- ration settings on the host. However, the CSP is responsible for

maintenance of the host and the underlying cloud infrastructure.: 1.

Platform as a service (PaaS): Platform as a service (PaaS)

• models provide basic computing resources to con-

sumers. This includes servers, storage, and in some cases, networking re- sources. Consumers install operating systems and applications and perform all required maintenance on the operating systems and applications. The CSP maintains the cloud-based infrastructure, ensuring that consumers have access to leased systems. The distinction between IaaS and PaaS models isn't always clear when evaluating public services.However, when leasing cloud-based services, the label the CSP uses isn't as important as clearly understanding who is responsible for performing

different mainte- nance and security actions.: 1. Infrastructure as a

service (IaaS): Infrastructure as a service (IaaS)

• includes assets available for any consumers to rent or

lease and is hosted by an external CSP. Service-level agreements can be effective at ensuring that the CSP provides the cloud-based services at a level acceptable to the organization.: 1. A public cloud model 3 / 4

• is used for cloud-based assets for a single

organization. Organizations can create and host private clouds using their own on-premis- es resources. If so, the organization is responsible for all maintenance. However, an organization can also rent resources from a third party for exclusive use of the organization. Maintenance requirements

are typically split based on the service model (SaaS, PaaS, or IaaS).: 1. The

private cloud deployment model

• provides cloud-based assets to two or more

organiza- tions. Assets can be owned and managed by one or more of the organiza-

• / 4