User Report

POST 1 – Please provide one reply to this post

Multi-layered security can be defined as an approach of network security which makes use of several components in order to safeguard the operations of ones clients through the security measures that are of multiple levels. They do not guarantee total failure of attacks because the main objective of having network security which is in multiple layers is to mainly make sure that every particular component of defense is installed with a backup in case there is a situation of a coverage which is missing or there is a flaw. This is mainly because personal strengths of every layer fill in for any weaknesses that might be available within other defenses (Li, et.al, 2018). 

Every particular layer within a security which is multi layered concentrates on a particular region where there is a possibility of vulnerabilities. Through working in oneness, these security layers provide a chance which is enhanced in preventing intruders from being able to breach the networks of a company as compared to using a solution which is single. The idea of security which is multi layered is from perception of having various measures of security to safeguard the network system from threats. Deep defense incorporates the opinion of not having an actual means in acquiring security which is complete against the malware threats (Patyal, et.al, 2017).

Multi-layered security levels do not provide total security against threats because; the strategy of security of the defense in on the contrary focuses on having the threat progress hindered till it is considered not to be a threat anymore. Additionally, there is no particular technique which is considered to be completely successful in data protection. The multi-layered security levels basically works towards ensuring that the loopholes in addition to gaps in between each layer are minimized significantly, leaving hackers with minimal chances of carrying out attacks (Zhang, et.al, 2017).

References

Li, D., Hou, H., Chen, C., Zhu, X., Li, M., & Yi, Q. (2018). Experimental study on the combined damage of multi-layered composite structures subjected to close-range explosion of simulated warheads. International Journal of Impact Engineering114, 133-146. Retrieved from https://www.sciencedirect.com/science/article/pii/S0734743X17306103

Patyal, M., Sampalli, S., Ye, Q., & Rahman, M. (2017). Multi-layered defense architecture against ransomware. International Journal of Business and Cyber Security1(2). Retrieved from https://www.researchgate.net/profile/Manveer_Patyal/publication/315471509_Multi-layered_defense_architecture_against_ransomware/links/58d13233aca272380eca20ad/Multi-layered-defense-architecture-against-ransomware.pdf

Zhang, J., Shi, X. H., & Soares, C. G. (2017). Experimental study on the response of multi-layered protective structure subjected to underwater contact explosions. International journal of impact engineering100, 23-34. Retrieved from https://www.sciencedirect.com/science/article/abs/pii/S0734743X16305231

POST 2 – Please provide one reply to this post

Discussion - Does a multilayered defense guarantee that attacks will not be successful?

COLLAPSE

Top of Form

Yes, having a multi layered defense help to ensure that it protects application, system from threat agents and such that each component act as a defense layer against different attack surfaces so that there is no gap among one another defense layer. Multi layered security approach focuses on particular areas where the surface can be susceptible to attack and vulnerabilities that may exist. Having multiple defense layer have better chances of detecting, protecting and defending against attacks by reducing the attack surface and from breaching enterprise networks and making it secure. Different kind of security defense can be used as a part of multilayer defense security which are mentioned below:

Web protection

Web protection provides a safeguard of from employee accessing to different websites and being victim of malware attacks, viruses and trojans. This layer can be used to defend the employees from accessing different sites that does not benefits the business-like recreational sites, non-productive social media etc.

Patch management

Attacks often occurred on software that are not updated to the security patch and are vulnerable to malware. Managing this layer will keep updates of the security patches, hotfixes, service packs and install them on appropriate devices.

Email security and archiving

Email phishing is the common way of getting access to the organization network. This layer protection allows to spot patterns on large volumes of the spam that can be identify and stop these phishing spam emails.

Vulnerability assessment and analytics

This layer helps identifies security hazards, analyze critical risk factors, identify vulnerable network devices. Analyze the risk factors implement a control measure to mitigate such risks and vulnerabilities.

Firewalls

This stand as first line of defense against the network and attacks. Use of multi-tier firewall near DMZ will provide better defense against attacks and threat agents. 

Privacy controls and Access Management

Developed of specific access control management will allow only specific user to enter critical application. When the other layer is attacked until specific groups are assigned to this user they can’t access certain application which reduces the attack surfaces. Identity governance and Segregation of duties active directory roles and groups help to defend against threat and protect the network.

Encryption and digital certificates

Using email encryption and data encryption methods can help to secure data emails from cyber-attacks. It helps to prevent occurrence of data breach and maintain data integrity and confidentiality. Using SSL or TSL certificates helps to encrypt the sensitive credentials that customer provides and maintain security of critical accounts.

Other security layer that helps to make a multi layered defense includes Mobile Security and Mobile Device Management, and Antivirus software.  Overall, having multi-layered strategies in place will definitively make data, identities and network secure which protect and defend organization sensitive information, maintain data integrity and reliability to customers.

References

Hoverman, D. (2018). What is the layered security & How does it defend your networks? 

(https://blog.totalprosource.com/what-is-layered-security-how-does-it-defend-your-network)

Bottom of Form

POST – 1 please provide one reply to this post.

1.Do you think nonrepudiation falls under one of the tenets of the C-I-A triad (confidentiality, integrity, and availability)? Why or why not?

A security model of any organization involves three main attributes called C-I-A triad which stands for confidentiality, integrity and availability. These three tenets of information security guides information security policies of an organization. One or more of these principals are violated when any kind of cyber-attack, data leak or data breach happens in an organization. Confidentiality assures that only authorized personnel or party can access an organization’s sensitive information or database thus keeping unauthorized access at bay. Integrity ensures that data do not get corrupted or tampered with and remains accurate, consistent and authentic over its lifecycle. Similarly, availability ensures that the data is available and ready whenever it is required. This is ensured by keeping all hardware working, minimizing downtime in case of unavoidable events by keeping backups and redundant devices, maintaining network etc. Now let’s come to nonrepudiation, Non-repudiation refers to a situation where a statement's author cannot successfully dispute its authorship or the validity of an associated contract. The term is often seen in a legal setting when the authenticity of a signature is being challenged. In such an instance, the authenticity is being "repudiated(Zhou, 2001). So, I think nonrepudiation falls under integrity category of C-I-A triad because non repudiation confirms that a message was send by its original sender and that its origin cannot be questioned with. This means that the message reaches the receiver untampered and in its authentic form which is what integrity also ensures.

 2. Is the C-I-A triad adequate when selecting controls for a Windows system? Why or why not?

In my opinion C-I-A triad although speaks a lot about information protection is not adequate when selecting controls for a Windows system. This is because C-I-A triad is entirely concerned with information only and do not talk anything about accountability and responsibility. Another thing is C-I-A model do not relate anything about the interdependence between its triads. For example, increasing confidentiality and integrity may result in compromise of availability (Solomon, 2021). This means a less available system can have more confidentiality and integrity than easily available system. Although availability ensures that we get easy access to the resource when needed but this does not mean that an unauthorized use of hardware is not possible. Also, the C-I-A triad do not talk anything about authentication which involves establishing the identity of a user.  

References

Solomon, M. G. (2021). Security Strategies in Windows Platforms and Applications (3rd ed.). Burlington, MA: Jones & Bartlett Learning.

 

Zhou, J. (2001). Non-repudiation in Electronic Commerce

POST – 2 please provide one reply to this post.

Nonrepudiation falls under one of the C-I-A triad’s tenets.Non-repudiation refers to the assurance that an individual cannot deny anything. Nonrepudiation typically is the ability of ensuring that a party to a certain communication or contract cannot deny the originality or authenticity of their personal signature on a given document or sharing a message or information that they originated("The CIA Triad: Confidentiality, Integrity, Availability - Panmore Institute", 2020).Non-repudiation needs the creation of various artifacts that could be used in disputing the claims of an organization, which denies being the originator of a certain communication or action. Suchartifactscontain a given identity, whose authenticity is the tangible evidence that connects an identified party to a certain action or communication. Digital signatures ensure data integrity by guaranteeing the identity of the sender. Digitalsignatures enforce the identity of a sender to ensure that the sender cannot deny the act later. Timestamps possess the date and time when the document was developed or composed in generating an evidence of,the availability of the document at that particular time.

C-I-A triad adequate while selecting controls for a given system of Windows. The CIA’s integrity can be verified by the use of a hashing algorithm. A hash of the message is essential generated and attached to the end of communication or message(Spiceworks, 2020). The person receiving the message calculates the message’s hash and compares it with the received hash. In case anything changed during the transit process, the hashes cannot match. The hashes used in storing data are completely different from hashes of cryptographic. Before the release of Windows NT, the operating systems of Microsoft were using the LANMAN protocol for purposes of authentication. This was replaced by the NTLM after Windows NT was released. 

References

Spiceworks, I. (2020). The CIA Triad and Its Real-World Application. Retrieved 20 June 2020, from https://community.spiceworks.com/topic/2205579-the-cia-triad-and-its-real-world-application

The CIA Triad: Confidentiality, Integrity, Availability - Panmore Institute. (2020). Retrieved 20 June 2020, from http://panmore.com/the-cia-triad-confidentiality-integrity-availability

Submit Your Homework

Let us help you with your homework, we will match you with one of our professional tutors.

My Info

Project Info

Due Date

Describe your Homework Problem

Budget (optional)

By providing your budget we will work on finding the best tutors that can work within it.

Get help from top-rated tutors in any subject.

Efficiently complete your homework and academic assignments by getting help from the experts at homeworkarchive.com