{"id":306,"date":"2020-05-25T19:49:06","date_gmt":"2020-05-25T19:49:06","guid":{"rendered":"http:\/\/www.spktechfit.com\/?p=306"},"modified":"2020-05-25T19:49:06","modified_gmt":"2020-05-25T19:49:06","slug":"security-course-3-1-security-design","status":"publish","type":"post","link":"https:\/\/www.spktechfit.com\/?p=306","title":{"rendered":"Security+ Course \u2013 3.1 Security Design"},"content":{"rendered":"

1. Legislative and Regulatory Compliance<\/h2>\n

Compliance Obligations<\/strong><\/h3>\n

There are 4 main types:<\/p>\n

    \n
  1. Criminal law<\/strong>: deter and punish acts detrimental to society (murder, theft, hacking etc…). This can result in jail time<\/li>\n
  2. Civil law<\/strong>: designed to resolve disputes between civilians, organisations etc… This cannot result in jail time<\/li>\n
  3. Administrative law<\/strong>:\u00a0 Facilitate effective government by allowing agencies to carry out their duties. They proved procedural rules for the operation of government<\/li>\n
  4. Private regulations<\/strong>: Flow from contractual relationships. Govern activities between individuals and organisations<\/li>\n<\/ol>\n

    Federal Information Security Management Act (FISMA)<\/h3>\n

    This is a law that governs information security matters for federal agencies and government contractors. It requires the creation of security programs throughout the federal government and provides details on the controls necessary to run information systems that are categorized as FISMA High, FISMA Moderate, or FISMA Low.<\/p>\n

    \n

    2. Security Frameworks and Reference Architectures<\/h2>\n

    These are invaluable tools as they design security programs.<\/p>\n

    Security Frameworks:<\/strong> A collection of standards and practices designed to form a solid approach to information security. They’re high level, and they’re often focused on activities such as identifying risks and responding to attacks.<\/p>\n

    Reference Architecture:<\/strong> This provides a proposed design for security technology. This gets more into the technical details providing the specific controls that would achieve an organisations security objectives.<\/p>\n

    National Institute for Standards in Technology (NIST) Cybersecurity Framework<\/h3>\n

    NIST publishes a cybersecurity framework that is free for anyone to use.<\/p>\n