CISA Domain 5 Exam Cram Part 1 2021

[MUSIC PLAYING]

Hello, team.

Good morning, good
afternoon, good evening.

And today we are
going to discuss

about CISA exam review, Domain
5, Protection of Information

Asset.

I already made one video on
domain 1, part 1 and part two,

and I got a great
response on that video.

And based on that, I
thought, let's continue

the series of that session.

And that is why I have
started with the Domain 5

first because lot
of CISA aspirants

are bit struggling
with the Domain 5.

So with that state of mind,
I am making this video.

If you are new to this
channel, do subscribe and click

on the bell icon so you should
not miss any of my videos.

And my name is Prabh Nair.

For more information, you can
refer my LinkedIn profile.

So let's start with
the first part.

OK.

The first part in this video,
in this particular session

or in the Domain 5, we have
information asset security

framework standard
and guideline.

So when you're talking about
industries, many industries,

they basically use standards.

They use frameworks
to build some kind

of a controls and governance
in the organization.

One example, we have
a PCI DSS, which

is used as a standard
for all organization

to process the payment cards.

So this is the example
of industry standard.

But compliance is not
required by the law

because it is just used to
achieve the defined objectives.

Then we have some standards
are found in many industries,

including a health care,
accounting, audits,

and telecommunication.

In some industries, such
as electrical power,

regulations require
compliance with the standard.

And to meet the
requirement of a standard,

framework is often used to
describe how the organization

can achieve the compliance.

Let's take an example.

If you talk about
one scenario here.

Every organization always
start with the strategy.

They create a strategy.

Strategy is called
as a long-term plan.

And then that
strategy is further

split into the tactical plan.

And then we have a
operational plan.

Now when you're talking
about this strategy

was created to meet
the GDPR requirement.

GDPR is a data
privacy regulation EU.

Now I have a company
in Kerala and they

need to comply with the
GDPR definitely because we

have some employees--

we have some employees here
who are residing in Kerala

and they're trying to access the
data, which is based out in EU.

And definitely, if you're
trying to access the data of EU,

you need to comply with GDPR.

So that were clear the
GDPR we need in the system.

But the question is
that, what controls

we required by which we can
able to comply with the GDPR?

So first thing what we did
we introduced the framework.

In Hindi, it is called dhaancha.

In English, it is called
as a structure, which

talk about the necessary
practice and procedures,

which required to achieve
the define objective.

Here, I want a privacy
system by which

I can basically compliance
my people process

technology with GDPR.

So I want a privacy
management system.

So we found some frameworks for
the privacy management systems.

And they basically have
a process and practices.

So one of the
process in practice

they say that, OK,
every system required

to be protected
with the password.

So they give me
one kind of freedom

that, OK, I want a
password in the system.

But now the question
is that, should I

go for a specific practice
and process, which

is given as per the
framework, or should I

go for any kind of a industry
standard for a benchmark?

And there, we basically
introduce the standard.

Now as per the ISO
27001, they say

that system must be protected
with the password with the eight

character.

So this is something is
a matrix we introduced.

So that is why we say
first we introduce

a framework, which helped
me to build the structure.

Same like when you
are building a house,

you first design the house.

Here, I need a balcony,
here you need a first floor,

here we need a second floor,
here we need a third--

Sorry.

We need a first room, second
room, third room, and then

we decide we need
a bed in each room.

So this is as per the design.

But what is a standard bed?

What is a standard sofa?

What is a standard
door we required?

So we used to say that
it should be ISO 9001

or they have their own standard.

So standard was
basically introduced

to measure the effectiveness.

Standard was basically
introduced to set the benchmark.

So whenever we are
building any kind

of a system in the organization,
first we adopt the framework.

The framework comes with
a practice and procedures.

And to enhance that
practice and procedure,

then we can go for the
specialization standard.

In this example, I want
to comply with GDPR.

I want a privacy system
in the organization.

So I adopted one of
the privacy framework.

Now, in that privacy
framework, one

of the practice and procedure
is must have a password.

Now I have a two choice.

I can create my
own password, which

can be used because
framework can be modified

as per your business objective.

But if you basically adopt
the standard because ISO

claim you must have
eight character password.

So eight character
is a strong password.

And tomorrow, when I claimed
in the industry that,

yes, I am a ISO 27001 certified
because I am following

their particular standard.

Same like CISA, you
are pursuing just

for knowledge that
is a framework.

But in CISA, you need to
read those stuff also,

which is not relevant
to your profile,

but that is required
for the exam

because tomorrow you
are going to use CISA

as a name standard in your CV.

So that is why in the Domain
5, the most important element,

you need to know the frameworks.

So that is why in the Domain
5, the Domain 5 itself,

starting with the auditing, the
information security management

framework and ultimate goal of
information security management

framework is to reduce the
risk to an acceptable level.

So we have a NIST
framework which

talks about the
best practice, how

to achieve the cybersecurity, or
how to achieve the information

security in the organization.

Let me show you the
document, how it look like.

So this is the document
we have for the NIST.

If you can see that, they have
organized the entire process

into some categories, like
identifies where they are

talking about we
need a governance,

and what is required
in the governance

they talk about these
are the practices.

And if you want to set
any kind of a benchmark

against something, you
need to claim we have

a respective controls also.

So you can see here.

Then if I zoom it--

now, if I join one
company and where

I want the information security
as a system I want to introduce.

So I can refer this NIST
framework based on my knowledge,

I can go by step
by step process.

They say, OK, as per the
framework control one,

you must have an
asset management.

Now in this case,
what is a subcategory,

like physical device and
system within the organizations

are inventoried.

Software platforms
and applications

within the organizations
are inventoried.

Organization communications
and data flows are mapped.

External information
systems are cataloged.

Resources are prioritized
based on the classification

criticality and business
value, and cyber security roles

and responsibility for entire
workforce in third party

establish.

Now they have a specific
controls for that in detail.

So for that, we can
refer the standard.

So standard was introduced
to measure the effectiveness.

So this is how we
can basically adopt

any framework I can basically
scope as per my business

requirement by which
I can eliminate

the need for implementing
this entire framework

and tailor it as per
my business choice.

So this is what we called as a
information security framework

or cyber security framework.

Now coming back, so in
Domain 5, the first part

we talk about audit the
information security management

framework so you can adopt
any kind of a benchmark, which

is approved benchmark
from the organization.

And based on that,
you can assess.

See, when we're talking
about any governance,

policy is the foundation
for any governance.

What is governance like?

In order to manage kids at home.

That is your governance.

Manage country, run
country's operation.

That is a governance.

So governance is
a-- governance is

an important part of the
organization and policy is

the foundation of governance.

If I say policy, policy is
the management statement.

Policy is the management intent.

Anything they want to
enforce in the organization,

they create a policy for that.

Example like every system must
be protected with the password.

So it's a policy.

Password must be
eight character.

Now we introduce as a standard.

Standard is a tool by which
we enforce the policy.

And how to create step by
step eight character password.

That is a written procedure.

Procedure always in
detail in nature.

So policy is
strategic in nature,

standard is tactical in nature,
and procedure is basically

operational in nature.

We create a detailed procedure
which is easy for people

to understand.

Now next thing is called as a
security awareness and training.

Now let me explain the
different-- thin line

difference between the
awareness, training,

and education.

Awareness is a short term.

I was in an impression that,
OK, eight character password

is a secure password.

So I was using a 12345678.

But when I attended any
awareness workshop which

modify my behavior and now I
get to know eight character

should not be only numeric.

OK, so I start using a
alphanumeric and spatial.

So that's something
modify my behavior.

The question is that how to
measure the effectiveness

of the awareness training.

By reviewing the
number of people

participated in the
awareness program?

No.

As an auditor, I
can able to evaluate

the effectiveness of
awareness training

is by seeing the number
of incidents reported.

Let's take an example.

Last week, we have conducted
the awareness workshop.

And at that time, we had
70 incidents was reported.

And this week, 140
incidents has been reported.

It means people are now more
aware about the incidents.

So always remember
the way-- in order

to measure the effectiveness
of awareness training

is increase in the
incident reports

and decrease in a
security violation.

So awareness modify
the behavior.

Training modify the skill, and
education modify your career.

Like doing a CISA
training, serious training.

See some training is a
part of a training which

modify your skills.

But annually you are
attending any college program

that is called as an education.

Another important thing
that you must be familiar

with that, which is called
as a data ownership.

Data ownership.

So data ownership is another
important thing we have

that you must be aware about.

In data ownership,
like data owner

is the one who ultimately
accountable for the data.

So whenever you
classifying any data,

you basically speak
to the data owner

only, because data owners are
best positioned to tell you

the value of the data.

The next important
thing is called as a--

yeah, can we transfer
the data ownership?

No, you can't transfer
the data ownership.

So on behalf of data
owner who manage

the data is the data
custodian because he

is responsible for storing
and safeguarding the data.

OK, like system analyst,
computer operator,

database operator, they are the
ones who are the data custodian.

Let's take an example.

I am the business owner.

I produce one data.

I bring more data
in the organization.

Now I have a IM team,
I have a database team

who manage the data
on behalf of me.

I will say, hey, Eric.

Please maintain my data.

So here the Eric will maintain
the protection of the data,

but he will follow
all my guidelines

according to that only
he protect the data.

I will clearly tell
him, see, this data

is basically based
on EU customer

so make sure you should
protect effectively.

So here I am a data
owner who instruct him

that this is the EU data.

If something goes wrong,
he going to question me

and it is a difficult-- it is
difficult for me to answer.

So here, the database
administrator,

based on my guidance,
going to protect the data.

So data owner one is the
one who value the data,

and data custodian--

data custodian manage the
data on behalf of data owner.

The third is basically called
as a security administrator.

Security administrator is
another important position

we have.

He is responsible for providing
an adequate physical and logical

security for the
information system,

and also providing a security
to the data and equipments.

So his role is more like a
implementer kind of thing.

Example, firewall administrator.

OK.

VAPT guys, control implementer.

These are basically called
as security administrators.

Then we have a new IT
users, the one who basically

join the organization.

Make sure they should read and
agree to the security policies,

keep login ID and
password secret,

create the quality
password, lock all

the terminals for the IT users.

Next is we have a data users.

Data user example
like the IT users

who are creating a data it is
accessed by the data user only.

I have a team who create a data.

OK, now you are basically
the one who review this data.

So you are the data user.

So the responsibility
regarding a security

and to be vigilant
regarding the monitoring

of the unauthorized
people in the work areas

and comply with the
general security guidelines

and policies.

So data users include the
external and internal user

communities.

Next, we have a
documented authorization.

So data access should be
identified and authorized

in a writing.

So as an IS auditor,
you should review

a sample of the
authorization to determine

if the proper level of written
authority was provided.

Example, I am an auditor.

I am going for an audit.

As per the audit, for this
kind of a permissions,

we need an approval from
the senior management.

So we will ask for the
sample of an email which

can confirm that
you are authorized

to access the document.

And the similar pattern you
can get in a CISA exam also.

Like you are an auditor.

You have discovered that some
access has been attempted

to access specific files.

Now how to verify.

What is the next step?

The next step is we will
request for those exceptions.

We request for
the email exchange

which say that, OK, you're
authorized to access

that particular documents.

Next important thing we call
that the terminated employee

access.

See, whenever any employee
leave the organization,

we don't delete his account.

We disable the account.

The first step is notify
all the Department

and the second step
is revoke his access.

But the question
talking about what

is the best action that we have
to take against the terminated

employee, the thing is
that revoke his access.

Termination is two-type:
voluntary and involuntary.

Voluntary termination
when employee resign,

and involuntary termination
when company say ask to leave.

But during this process,
during a termination process,

IS auditor need to review that
any terminated employer is

having access to the
system, and that is also

one of the biggest concern.

If terminated employee
already left the organization

and he still has access
to the organization,

then it's the biggest concern.

So from an exam point
of view, remember

this is one of the
biggest concern we have.

Whenever we implementing any
kind of a control, security

baseline we have to follow.

What is baseline?

Baseline is a minimum
level of security

that we need to
follow in the system.

Let me explain you
with the reference.

Now I want a baseline
for my organization.

OK.

So I want a baseline in--

So like-- example like--

I want a baseline
for my system so--

for my systems.

Baseline mean minimum security.

I want a baseline like password.

I want a baseline antivirus.

And I want a baseline called
as a security solution.

OK.

So this is basically
the baseline one,

baseline two, baseline three.

So example, we have a system
1, system 2, and system 3.

So in a system 1,
password we require.

That is a minimum thing we
need in the organization

in the system.

Now, question is
password is required.

I agree.

Now here I can refer a standard.

OK.

Can we go for the
eight character?

Yes.

And then we decide
the procedure.

So if you notice, I started
with the baseline of the system,

like I want a password.

Is a minimum I need a
password in any system.

I want antivirus and I want
for the system security.

Now with the
reference of password,

I decided I will use eight
character as a minimum password

in the system.

And then I will create
a detailed procedure

how to do that.

So baseline come with the
standard and procedure

policy come with the
standard and procedure.

So you must be familiar
with the security baseline.

And whenever you
conducting an audit,

you can adopt the baseline.

As per that, you
can able to conduct

the audit in the organization.

And any kind of a deviation you
identified from what is agreed

and what is there, you can
document that as a finding.

So what is the best
practice we follow?

So standard for security may
be defined at a generic level,

then for a specific machines,
or for a specific application

system.

So let's move to the next part.

Next section is a very important
section in Domain 5, privacy.

First of all, let me
explain you the difference

between the privacy and secrecy.

Privacy deal with the
individual and secrecy

deal with the organization.

That's why in the
organization you

have seen the top secret,
secret, and all that.

See, when the law
was introduced,

law introduced to protect
the interest of the people.

Now in different,
different business sectors,

we have different industries.

Example, in India, we have
a food, we have a insurance,

we have a bank.

Now, if you want to start any
kind of a insurance business,

I need to comply with the IRDA.

So what is this?

This is the agency.

This is the
regulation authority.

And similar thing,
if I want to start

any kind of a food
services, I need

to be comply with the FSSAI.

So regulation
authorities are basically

introduced in every country to
control a respective industries

and to make sure that business
should be comply under the law

parameter.

Compliance is nothing.

It is all about act of abiding.

So privacy is the
utmost priority

in every organization
because directly

map with the individual.

So privacy significant
aspect for the IS auditor

also, especially in the light
of the global regulations,

such as GDPR.

GDPR basically is a national
privacy regulation of EU,

but US does not have a
national privacy regulation.

They have an industry-specific.

Example, they have a--
for the health sector,

they have a HIPAA.

For the finance,
they have a GLBA.

So this kind of
regulations we have.

So to understand what is
the level of privacy we need

in the organization or what is
the level of privacy control

we need in the systems, we
perform the PIA, privacy impact

assessment.

And based on that, we implement
the privacy management system

in the organization.

So what is a good practice?

So if I say my organization--

OK, if I say my
organization need

to be comply with GDPR, example.

So I need to comply
with the GDPR.

So what I need to do first
is I need to create a policy.

So by the policy, I can
comply my people, process,

and technology to
be with the GDPR.

How?

See, I cannot go to each and
every individual and process,

and technology and explain
about the GDPR articles.

So what we did, we include
the GDPR information.

So we translate the
GDPR information

as an intent in the policies.

And then I enforce the
policy in the organization.

So where people process
technology need to be comply.

So by comply with the
privacy, you automatically

comply with the GDPR.

So this is how you can able to
bring the privacy best practices

uniformity in the organization.

That's why we say
policy is the best

tool to be compliant with
any regulatory requirement.

And that is why senior
management intentions

comes in the policy only.

So privacy has some good
practices that must be follow,

like private data should
be collected fairly

in a open, transparent manner.

So if I say this organization is
following the effective privacy

practice or they have a
good privacy practice,

how to check that is they
collect the data fairly,

open, transparent manner.

Example you visit
one website which

say how are they
going to use the data.

They are going to explain
about how they are basically

managing data.

So that shows their
privacy best practice.

And private data or privacy
data should be kept securely

throughout the lifecycle,
from the creation

phase to the destruction.

And the third most
important thing

is that your private
data should be accurate,

it should be complete, and
it should be up to date.

OK, so to best meet
this challenge,

management should
perform the PIA,

and IS auditor can ask for
the last review report.

This is how as an auditor
can able to validate

as the company is compliance
with any privacy practices.

With the continuation
of the previous series,

so this is the second
part of the Domain 5.

And in this section,
we are going

to discuss about physical access
and environmental control.

Physical access
environmental control

is another important topic
we have in our Domain 5,

and it is a bit difficult
for the people who

are from a non-IT background.

So as an IS auditor, you need
to evaluate these controls.

And in many organizations,
these controls

are designed and implemented
by the facility management,

not by the information
security manager IT.

One example I can give you
about the physical access

and environmental control is
HVAC system, heat, ventilation,

air conditioning.

You have seen the AC
in your facilities.

It is control from a system.

We have a AC in the
data center also,

cooling system in the
data center, which

is used to maintain the optimum
temperature by which we can

able to maintain the
performance of the hardware

because excessive
heating of the hardware

will impact the performance.

So what controls we required?

OK, that we need
to understand here.

As an auditor, I
will first obtain

the approved list of controls.

And then I will assess
the existing control based

on that particular parameter.

And any kind of a
gap we identify,

we will document
that as a finding.

So in this, when you're talking
about the generic controls,

we have a three
type of controls.

One is called as a
managerial control.

It is also called as an
administrative control.

Then we have a technical, then
we have a physical control.

Managerial control is more like
a direction, more like a order.

Example like
post-COVID, the company

has announced that you have
to join office from January

and everyone must come with
their vaccination certificate.

So this is a kind
of an order, which

is used to control the
behavior of the people.

Now people know
that, OK, we need

to have that COVID
vaccination certificate.

Then only we can able
to come to the facility.

So it is like a control
to monitor and improve

the behavior of the people.

One more example of an
administrative control

is without vaccination
certificate,

no one is entered
into the office.

No one is supposed to
enter into the office.

So it's a company announcement.

So it is more like a
managerial control.

Second, we have a
technical control.

The technical
control is something

which is technical in nature.

Example, firewall.

Now it's not something you
pick every packet and inspect.

No, right?

So there is a tool involved in
which we have created a rules.

And based on the rule, the
tool will capture and block

the packet.

So there is a technical
control there.

Function is involved to
block or detect the attacks.

Then we have a physical control.

Physical control is
like a physical lock.

OK.

Placement of a security guard
which try to block physically.

So we have a three
type of controls.

See, when you're
talking about controls,

control may be
proactive, which means

they can attempt to
prevent an incident,

and it can be
reactive, which allow

the detection, containment,
and recovery from an incident.

So proactive control are called
as a safeguard and reactive

control are called
as a countermeasures.

Sorry.

OK.

So that is basically
called as a countermeasure.

So we have two type of controls.

Example like before going--

protect from COVID and all
that we have vaccinations.

So that is basically called
as a proactive control.

But if vaccination
become ineffective,

you got impacted with the
COVID, the reactive control

is isolate yourself
from the family

and then you can go for the
14 days period of containment.

So this is how we have a
proactive and reactive.

So next point is called
as a control monitoring

and effectiveness.

Just implementing
a control will not

achieve the defined objectives.

We need to also need to
check whether control

is working effectively.

It is same like we just
hire the security guard

and now we trust that guard
that he going to block everyone.

No.

We also see how effectively he
responding to all the threats

and everything.

Same like when we
configure the firewall

and simply creating a
rules in the firewall

it doesn't meet my objectives.

On a regular basis, we
need to test the firewalls

by sending a malformed
packets and see whether it

can able to detect and block.

So as a controller design
implemented and operated,

IS auditor should ensure the
logs are enabled because that

is how you can able to track the
effectiveness of the controls.

And we also need to
ensure as an auditor

we need to ensure they are
testing on a regular basis.

OK.

And the procedure should
be developed by which they

can able to test effectively.

And as an IS auditor
should also ensure

they should have a capability
to monitor the controls

and support the monitoring
system in the control design.

Next thing is called as a
environmental exposures.

See, environmental
exposures are due primarily

to the naturally occurring
events, such as lightning,

storms, earthquake, volcanic
eruptions, hurricanes,

and extreme weather conditions.

So one particular
area of concern,

which is coming from an
environmental exposure,

is called as a
damage of equipments.

Right now I'm doing
this training.

Suddenly there is a power
issue and it directly

impacts my hardware.

And because of that, my system
get shut down or it get restart,

or it can damage.

So as an auditor, the
biggest concern for us

is the damaging
of an equipments,

because if the
equipment is damaged,

then it directly impact
the availability.

We have a different kind
of a threats associated

with the hardware equipment,
like total failure,

voltage reduce, spike, surge.

So that's why we purchase
one system, which

is called as a PCS, power
conditioning system.

In your home, we
called as a stabilizer,

which is used to stable
the power supply.

Along with that, we must
require the UPS and generator

to prevent all the
uninterrupted interruptions.

So these kind of controls
you can basically

introduce to prevent this
environmental exposures.

The next important thing is
called as a physical access

exposures and control from
the auditing perspective.

We also buy a alarm
control panels--

so we also buy alarm
control panels,

which is separated from
a burglars or security

system, which is
located on the premises.

We also go for the
smoke detectors.

We have a smoke detector.

It gives the early
warning of the smoke.

So this is the smoke
detector we have.

If there is a smoke in the
room, it get alert and notify

the concerned person.

OK.

So detector should produce the
audible alarm when activated.

It should be linked to the
monitoring system, but make sure

this monitoring should
be separate from the fire

department.

We also need a
visual verification

of the presence of water
and smoke detectors

in the computer rooms.

I'm sure you have seen the
buckets in a red color.

We also need a hand
pull fire alarms that

should be placed strategically
throughout the facilities,

and it should be
placed in such a manner

that it should give
the visibility.

That's an important thing.

And that also, that
fire extinguisher

should be tagged for inspection
and inspected at least annually.

So as an auditor, if you want
to audit extinguishers and all

that can check the
last review period.

If it's basically exceed
by more than one year,

then you can raise that as
a finding in your report.

But before that, confirm why it
got late, why there is a delay.

But one more important thing
as a auditor, testing fire

suppression system
is also expensive.

The fire suppression system,
it's always expensive to test.

And therefore, as
an IS auditor, they

need to limit their
test to review

the documentations
to ensure system

has been inspected and
tested within the last year.

We also have a different
kind of controls,

like we need a biometric,
something you are--

OK, we can place
because that provide

the appropriate type of
accountability in the data

center.

Because in data center, if you
just access the data center

based on your ID
card and all that,

tomorrow you can
deny it was not you

who accessed the data center.

You can tell him that,
OK, I misplaced my card

and everything, so might
be in my absence someone

has used the card and
accessed the data center.

So data center need to prefer
the strongest accountability,

and that is why we need a
biometric in the data center.

But when you're talking
about the biometric,

the biometric is vulnerable
for the two errors.

One is called as a FAR and
one is called as a FRR.

False acceptance
rate, where false user

accepted by the machine.

Example, I am not
authorized user,

but machine has accepted
me as an authorized.

It has happened sometime when
I try to mimic someone voice.

They assume it is actually
authorized user and give me

access.

That is called as a
false acceptance rate.

It is a biggest
concern for an auditor.

And false rejection rate where
the authorized user falsely

rejected by the machine.

Example, like-- example, like
I came back from the office

and I was wearing
gloves and all that.

My hands are completely
dry and all that.

So when I'm trying to place my
fingers or thumb on the scanner,

it has failed to recognize.

So this is basically
because of FRR.

So the point where FAR and
FRR basically intersect,

that is the best optimum point.

So that is the most important
thing we need to consider.

Another important point
that we need to understand

is security guards.

Security guards are very useful
if supplemental by the video

cameras and lock doors.

So guards should be supplied
by an external agency that

should be bonded to
protect the organization

from all kind of losses.

We don't hire the
in-house security guards

because this is how
frauds are possible.

So we outsource a third-party
agencies which hire them,

and this is how we separate
the job activities.

So let's move to the next part.

The next section is called
as the identity and access

management.

See, we have IAAA,
identification, authentication,

and authorization.

Identification, authentication,
and authorization.

Suppose I went to airport.

I went to airport and I
say, hey, my name is Prabh,

and I'm traveling from
Trivandrum to Delhi.

So they will check
my name in the list.

Yes, they confirm
my name in the list.

But they also need
to confirm, is it

a same Prabh who claimed to be?

I will show my Aadhaar card.

I will show my PAN
card that basically

prove, yes, I am Prabh.

So that is called as
an authentication,

the person who claimed to be.

And based on that,
they give me the access

to a specific seat, that is
called as an authorization.

Under the authorization, we
also use the access control.

So we have a different
type of access control.

But in CISA, they talk about
two type of access control.

One is called as a mandatory
and one is called DAC.

What is DAC?

DAC stands for
discretionary, which is also

called as a distribution.

Before marriage,
my life, my rule.

Same like that, which is called
as a distributed access control.

What is the meaning
of that is, suppose

this is the system we
have, system A. OK.

So we have a user 1, we have a
user 2, and we have a user 3.

User 1 login into the system
and he create a folder,

but he deny user 2 and user 3.

User 2 login into the folder,
user login to the system,

and he create a folder.

He deny user 1 and user 3.

User 3 login into the
system, he create a folder,

and he deny other two.

So same your
workgroup environment.

When you login into your laptop
or desktop, you create a folder.

You deny your family member.

One of your family member has
access to that particular system

and they create the
folder, they deny other.

So this is called as a
discretionary, distributed

access control, where
the multiple parties are

involved in giving an
authorizing access.

But when we're talking
about the mandatory,

it is a default system access
used in a military and all that.

And the best example
is in your windows,

if you really want
to modify the CMD

or you want to access
any application,

you need to run as
an administrator.

That is a mandatory thing.

So it's an access
control, which is

default embedded in the system.

And that is called as
a centralized access

control, which is also
called as an NDAC.

So MAC is a system-based access.

They have a predefined logics.

In CMD, if you want to
perform some admin command,

you need to run as a CMD.

In the Linux, if
you want to perform

any kind of a admin activity,
you need to run sudo command.

It is a mandatory
access control.

So when you're talking
about authentication,

authentication basically
has a three factors.

Something you know, which
is your password, which

is easy to compromise;
something you have,

which is called as a ownership,
and something you are,

which is a biometric, and
somewhere you are nowadays.

So token device and one-time
password is something you have,

which is called as a ownership.

Next is called as
a single sign-on.

Single sign-on means
you log in once

and access the
multiple resources.

An example, imagine like--

when you're talking about a
single sign-on, one example

we have about Gmail.

So you open the gmail.com,
you log in to the Gmail,

and from there, you open
doc, D-O-C, dot google.com.

It doesn't ask for the password.

Then you type YouTube.

It doesn't ask for the password.

Then you type any document.

It doesn't ask for the password.

When you open Drive, it
doesn't ask for the password.

So that is the best
example of single sign-on.

You need to authenticate once.

And based on that, you can able
to access any number of services

of a Gmail.

But single sign-on is a concept
we use within a one domain.

But federation, I'm
sorry for the spelling.

In hurry.

I'm sorry.

I can correct that.

So federation is basically where
you authenticate with one domain

and access the other domain.

So federation we use
between the two companies,

between the two domain.

Example like we have a
booking.com and we have a Gmail.

I'm sure you have noticed
user went to booking.com.

Now booking.com
giving him option,

log in with your
Google ID or sign up.

Definitely to save time, I will
select login with the Gmail ID.

So booking.com redirect
user to the Gmail.

To the Gmail, I will
basically provide my username

and password, and against that
Gmail provide the authorization

ticket, and that authentication
ticket or authorization ticket

I will provide to Booking,
which confirm, yes, you are

the authorized user of Gmail.

And based on that booking.com,
provide the resource.

So in this case, Gmail
is the identity provider

who verify your identity
and booking.com is

a service provider who
provide you services.

So federation is basically used
across the multiple systems.

Biometric establish
the strongest form

of accountability,
which cannot be spoofed.

So we have a two scanners.

One is called retina.

And we have a second
is called as a iris.

Iris is-- so when you're
talking about retina,

retina scan the blood
vessel of your eyes.

OK, very accurate, but difficult
to implement because it has

acceptance issues,
whereas the iris

is accurate with acceptance.

If you ask me which
was more accurate,

retina is more accurate
because difficult

to spoof someone's
blood vessels.

But iris is a second
best accept and accurate.

When we are going for
the biometric solutions,

as an auditor, we also need
to check the privacy policy

because implementing a biometric
system in the organization

requires the user acceptance.

OK, so acceptance
for the solution

is very less in
the organization.

So we need to review the
data privacy policies

and see how they're going
to use the biometric data.

So let me explain you how the
biometric enrollment works.

So whenever you
register for biometric,

suppose this is the
scanner we have.

Suppose this is the
scanner we have.

So you place your fingers or you
place your thumb on the scanner.

Scanner will capture the image
and stored in a form of minutes.

Minutes we call it--

minutes or metrics we call.

Or you can say in
a form of template.

It store in a form of template.

So next time when
you place finger,

it basically scan and
generate that template

and compare against
the stored template.

If it match, it give access.

So this is-- they do like a
one-to-many or many-to-many

identification.

Next important
thing audit login.

It's very important
to log everything

by which we can able to
track the accountability.

So audit logging is
another important practice

we need to follow.

The next solution we have a
DLP, data leak prevention.

Ultimate objective of DLP
is to ensure data should not

live in an unauthorized manner.

You have seen a lot of employees
use their confidential data

and they try to send on
their public portals.

So we need to prevent
this data exfiltration.

Data exfiltration
definition means

data should not leave the
organization environment.

So we have a DLP here,
we have DLP here.

So example I connect
the pen drive

and trying to copy the data.

That is also data leaving
in an unauthorized manner,

but DLP there will try to block.

You opening a Gmail and try
to upload data on a Gmail.

So there is an endpoint
DLP or network-based DLP

will try to block the content.

So ultimate goal of a DLP is to
prevent the data exfiltration.

It is not a solution
introduced to monitor what is

coming from outside to inside.

No.

It is a solution which monitor
what is leaving the organization

data.

What is leaving the
organization control.

Because internal threat
is a difficult threat.

It's a concern for
the organization

and it is the biggest
threat for the organization.

The next thing we have network
and endpoint security, most

important section of Domain 5.

Now we have a different
type of circuits.

What is circuit?

Circuit is a link by which
we transfer the data.

So when you're talking about
circuit, the first circuit

they are talking about
dedicated circuit.

So we have a user A and we have
a user B. Same like the circuit

is a link which is basically
up between the two party.

And you send the data
through this link.

Another example is
you call your friend.

So what you have to do?

You need to dial his number.

And once you dial his number,
the link will be established.

And then you communicate.

And once it is done,
you basically discard.

But that is a circuit.

But that is not a dedicated.

It is a temporary circuit.

But dedicated circuit
is link is always up.

Whenever you dial,
it will be available.

Second is called as
a switch circuit.

Switch circuit I gave you the
example of the switch circuit

is you dial the person
number, you temporarily

establish the connection,
you are done, and you finish.

You are done with that and
you can discard the things.

So that is the difference
between the dedicated and switch

circuit.

We also have a packet
switching technology.

Packet switching technology
today is used in a 4G.

I am sure you have
seen the Jio, Airtel,

and all that offer the packet
switching technology only.

That is why if you
do the WhatsApp call,

it has a better quality
than the voice call

because packet switching
was primarily introduced

for the data transfer.

Let's take an example.

We have a system
A, we have a system

B. So this is my internet.

We have a routers here.

So what packet switching
does, we have a data here,

data divided into packets.

So some packets goes
through this route

and some packet goes
through this route.

And by end of the day, it
get delivered to the B.

It doesn't give assurance in
what state it basically receive,

but they just send the data.

That is where the packet
switching is primarily

designed for the data transfer,
not for the voice transfer.

That's why if you're
in your 4G phone,

you can see the V-O-L-T-E. OK.

And your landline, it's
not having a dial up tones.

It has some other tones.

So today your all
calls is basically

done through VoIP by using
a packet switching only.

You also need to understand
the different type of networks,

like LAN, which is basically
a group of computers

within the organization, a group
of system over the internet that

is called as a WAN, and access
the storage is called as a SAN.

DNS is a service which translate
name to IP and IP to name.

Let's take an example
of the smartphone.

It is difficult for you to
remember your friend's number.

So what you did, you saved the
friend's number with the name

because human mind remember
alphabets over the numbers.

So if I want to call
my friend Pankaj.

So I will type Pankaj Delhi.

So it will see by name and
it map with the number.

So automatically
dial the number.

Same like you open a
browser type google.com.

They send the request to
a specific server which

translate the name
to IP, and then it

will redirect you to the
particular web server,

like this way.

So we client and we
have a DNS server here.

And this is my web server.

So client has
requested google.com.

That request goes to DNS.

DNS said, no, boss.

Google.com on 1.1.1.1.

And this is how it
redirect to 1.1.1.

And then web server
provide the content.

So DNS is a service which
translate name to IP and IP

to name.

The next thing is
called as a DHCP.

DHCP is a service
which basically

provide the automated IP
address to all the systems.

It is difficult to manage
the IPs in every system.

So what I need, I want
a one centralized server

from where I need to assign the
IP address to all the clients.

The next important topic
is called as a topology.

Topology is provide the
layout of the network.

And then we have a media type.

So we have a twisted
pair and fiber optic.

Twisted pair are
twisted together

by which it reduces
the attenuation.

What is attenuation?

Is loss of signal.

Fiber optic is basically
providing a very effective

speed, and it is having a low
latency and better than twisted

pair to send the sensitive data.

So this is the first part
of this particular series.

I'm planning to make
another series next week

and we'll see what can be done.

This is just a first
part of the Domain 5.

If you find this video useful,
do share your feedback and do

let me know what are
the other videos should

I make on the CISA?

Thank you.