The image at left is from the first issue of an Intel marketing magazine called
Premier IT. I like it because it shows many of the terms I try to describe in this blog, in relationship to each other. In English, the graphic says something like the following:
Threats exploit
vulnerabilities, thereby exposing
assets to a loss of
confidentiality/integrity/availability, causing
business impact.
I disagree that business impact is mitigated by
controls. I think those terms were connected to make a pretty cyclical diagram. I would also say that
controls mitigate attacks (exploits) by threats, not the threats themselves. Imprisonment mitigates threats.
The next diagram shows Intel emphasizes
Policy at the base, followed by
Training and Education, then
Technology and Testing, and finally
Monitoring and Enforcement. I think the Training and Education piece is marginally effective at best, at least for the general user population. It's tough enough for security pros to keep up with the latest attacks. It's impossible for general users. The school of hard knocks (i.e., experience) is doing a better job teaching the general user population not to trust anything online. I like the recommendation for
Continuous monitoring for attacks and policy violations.
The last diagram positions most of the components of digital security within context. It includes
Governance and Personnel,
Physical Security,
Network Security,
Platform Security,
Application Security,
Storage Security, and
File and Data Security. I like this image because it makes me question what aspects of this environment I understand and can personally implement.
Comments