Speaker A
In the name of God, the Most Gracious, the Most Merciful. Welcome to our Computer and Network Security course.
Lecture on the 17 security functional requirements (from FIPS 200) for computer and network security, covering access control, awareness, audit, contingency planning, and identification.
Key Takeaways
- Security requirements are organized into 17 areas based on FIPS 200 to protect confidentiality, integrity, and availability.
- Accountability depends on complete audit logs tying every action to a single responsible individual.
- Security controls must be assessed continuously because new vulnerabilities appear daily.
- Robust contingency plans with backups and recovery procedures are essential for restoring systems after disasters or breaches.
- Personnel security and proper media sanitization are critical, since human and physical data handling are major risk sources.
What the video covers
- Introduces security functional requirements as countermeasures to protect confidentiality, integrity, and availability of information.
- Explains that the 17 requirement areas come from the FIPS 200 standard published in 2006.
- Covers Access Control: only authorized users, processes, and devices may access data, and transactions are restricted.
- Covers Awareness and Training: managers and staff must understand security risks, laws, and policies, and be properly trained.
- Covers Audit and Accountability: operations must be logged so problems can be tracked, investigated, and linked to individuals.
- Covers Certification, Accreditation, and Security Assessment: periodic assessments of security controls, with plans to close gaps as new vulnerabilities emerge.
- Covers Configuration Management: maintaining baseline hardware and software configurations and documentation throughout development.
- Covers Contingency Planning: emergency response, backup, and post-disaster recovery to restore systems to their original state.
- Covers Identification and Authentication: verifying identities of people, processes, and devices before granting access.
- Covers Incident Response and Media Protection: handling breaches, protecting paper and digital media, and sanitizing or destroying data properly.
Chapters
- 00:00Introduction and Overview of Security Requirements
- 01:36Access Control and Awareness/Training
- 03:16Audit, Accountability, and Security Assessment
- 04:32Configuration Management and Contingency Planning
- 07:10Identification, Authentication, and Incident Response
- 12:12Media Protection and Physical Security
- 17:55Personnel Security and Third-Party Controls
- 25:52System Communications and Administrative Controls
Full Transcript — Download SRT & Markdown
Speaker A
Today, we will discuss Section 1. Security Functional Requirements. The functional requirements for any security system. So, what are the functional requirements? For me to have any security system, it must have requirements. The requirements here are essentially the countermeasures taken
Speaker A
to secure our system. These countermeasures available to us are divided into 17 different areas based on functional requirements. Why did we say 17 areas, of course? Because these 17 areas come from a standard called FIPS 200, which appeared in 2006,
Speaker A
dividing security requirements into 17 areas. Understood. So, what is our goal with these 17 areas? To protect the confidentiality, integrity, and availability of the information present in our system. Whether from the perspective of. Processing, storage, or even transmission over the network. So,
Speaker A
what are the 17 standards? We will go through the 17 standards one by one.
Speaker A
From access control, training awareness . To, finally, system and communication protection, and system information integrity. So, let's come to the first standard, which is Access Control.
Speaker A
Access control says that information I have. Must have access restricted only to people authorized to access this data. Or to processes, which are operations acting on behalf of whom? On behalf of the people authorized for the data. Or devices belonging to the
Speaker A
authorized people. So, who will see the data I have? The authorized user, in addition to whom? To the authorized processes of the authorized user and the authorized devices belonging to whom? To the authorized users.
Speaker A
Understood. Also, I need to define or restrict the types of transactions present on our system. Understood.
Speaker A
Consequently, not every transaction is allowed on the system. Only transactions coming from whom? From authorized users who are permitted. And not every function is allowed for every user. Okay. The second standard is awareness and training. I will implement this standard based on two
Speaker A
principles. The first principle is that managers and users must have sufficient awareness of the security risks associated with the activities they perform on the system. This allows them to avoid existing problems. In addition to knowing the laws, regulations,
Speaker A
policies, and procedures applied in our system, to avoid any legal or operational work issues. Understood.
Speaker A
The second point states that personnel must be—that the staff I have, the human staff or the functional staff I have, must be sufficiently trained and equipped to work on our systems.
Speaker A
Understood. Okay. The third standard or requirement we had is Audit and Accountability. Audit means auditing, or as we call it auditing, which is the process of recording every operation that happens within our system.
Speaker A
Therefore, every company is required to create, store, and protect all the operations that take place within it.
Speaker A
For everyone who performed any operation, take a snapshot of the log before and after this operation. So, what is the benefit of this? The benefit of this is simply that if I have any problem in the system, I can
Speaker A
track, analyze, and investigate. Consequently, I can issue a report on the cause of the problem and who were the people involved in it. Now, what is the relationship between audit and accountability? Accountability means being answerable. Answerable for what?
Speaker A
Answerable for the problem that occurred in our system. So, regarding the problem that happened in our system , who should I hold accountable? I need to hold the individuals who performed the wrongful actions accountable. Right . Therefore, if I do not have a log of
Speaker A
the actions or all the actions that took place on my system, I won't be able to hold anyone accountable.
Speaker A
Consequently, all actions on our system must be linked only and strictly to one person. Only one person, so I can track them. And say what problem they caused.
Speaker A
Now, the fourth requirement we have is Certification, Accreditation, and Security Assessment. Which is certifications. Accreditations, and security assessments. It says my company must have periodic assessments.
Speaker A
Which are the security controls. These are the systems, rules, or standards applied to security. To determine if they are sufficient or not. In case they are sufficient, that's great. In case they are not sufficient, we need to improve this. We create a new plan
Speaker A
that addresses the shortcomings we have here. So why do we do this? Because, quite simply, new vulnerabilities are discovered every day. Every day, new methods of attacking systems are being invented. Therefore, we need to reduce or eliminate the vulnerabilities. Which
Speaker A
are the points of weakness present in our system. It says my system must undergo continuous monitoring. And thus , we ensure that the system is in the best security state. Now, Configuration Management. For every system I have to
Speaker A
start working, it must have basic settings. And it has subsequent settings. So, as an organization, I must have the basic settings or baseline configuration ready. And any additional configuration must be attached to the basic configuration. So , what does the configuration relate to
Speaker A
? It relates to hardware and software. To the company's software, the original software from the vendor, and documentation. The documentation related to all of this. It says this process must be done throughout all stages of our network development.
Speaker A
Correct. The configuration must be fully applied and implemented as required. Now, it says Contingency Planning, the sixth requirement we have , is emergency planning. If an emergency occurs. What do I mean by an emergency? Simply put, we have a storm.
Speaker A
We have bombing. We have an earthquake. I need to determine who. I need to ensure I have a plan for emergencies.
Speaker A
Emergency planning including emergency response. The disaster has happened, what should I do? Backup operations.
Speaker A
After I managed to control the situation, how do I restore the system to its base state? I need to have a backup. All right. After post-disaster recovery. This backup of mine, after the disaster ends, how do I restore the
Speaker A
system to its original state? I will go to the last active version I took during the backup operation and load it into the system. So I will have a system. My system has suffered a disaster. It tells me you have the
Speaker A
original system. Which is system A, from which you have taken a backup. The backup I took of A, now A has a problem . I want to return A to its origin. How will I return it to its origin? I will
Speaker A
take the backup copy and upload it. All right. And load it onto it. If I have an emergency response. For example, my system has been breached. What is the first thing I need to do? It tells me the first thing I need to do is stop
Speaker A
the connection to the external network. Okay, we stopped it, we cut off the connection to the external network. The second thing is having previously taken a backup, which is A*, then the third step is that I want to restore the
Speaker A
system or the plan. How do I take the backup version and make it the effectively active version now? All right. So we have three things. Plans for emergency response, for backup, for post-disaster. I must be sure that They
Speaker A
are always available and present for us continuously. In case of an emergency, the emergency operations must be permanently active. Okay, identification and authentication. It also tells us that identification and authentication are requirements. I cannot have just anyone enter the
Speaker A
system. Any person entering the system without being known who this person is. So I always need to. Identify the identity of persons, processes, and devices that will enter our system. All right, we identified the persons, information, processes, and devices.
Speaker A
After that, are these persons, processes, or devices authorized to access the system or not? If they are authorized, I let them in; if not, I don't. Thus, in security systems, I have no unknown users. All users on my
Speaker A
system, especially the information system of the organization I work in, must be known; everyone entering this system must have an identity, a name, so I can link the actions they perform in our system to them. In order to hold
Speaker A
them accountable or control the process flow. It tells me that incident response is related one way or another to whom? To contingency planning. Okay, to emergency planning. It tells me that incident response or response. To disasters, it tells me. This
Speaker A
essentially happens where? When we have breaches. My process must involve preparation. Then detection of the error that occurred. Or detection of the breach that occurred. After detecting the error, I need to analyze the cause. Then I want to try to
Speaker A
contain it. After containing it and minimizing or preventing further damage from it, I want to try to return to whom? To the main process, to the basic state before the breach, which we call recovery. After that, I want to see the
Speaker A
user reactions after this problem happened to us. Did people lose their trust in our system? Or did their trust remain? Starting from here, I decide whether to improve or keep my current plan. Well, For my organization to build a strong incident response and a
Speaker A
reliable foundation, I must track every incident, breach, or issue in the system. I need to identify it, know who caused it, and understand its cause.
Speaker A
After identifying the actor and the cause, I must document it. What is documentation? Writing this down to create a record. After documenting it, periodically, or after an incident occurs, I must report it to whom? To the relevant authority. Every company
Speaker A
must track incidents, breaches, and others within the organization. After tracking, I document the cause, the vulnerability, the individuals involved , how they exploited it, and the resulting damage, then report it to the relevant entity. Or to the state,
Speaker A
depending on the severity of the issue. Okay. The ninth requirement is maintenance. Maintenance means keeping things running. What does maintenance mean? It says the company must, periodically, and at specific times, perform maintenance on our organizational systems. Why do we do
Speaker A
this for our organizational information systems? To ensure that our information remains correctly available. The system shouldn't stop unexpectedly. Right. Any issue discovered by the software vendor in other systems and for which a patch is released, I can apply it to ours.
Speaker A
Right. So, what does it provide? It provides effective control. Control over whom? Over the tools, techniques, mechanisms, and our staff. Okay, media protection. What is meant by media protection? Media means storage media.
Speaker A
What does media include? Physical media like papers, or digital media like USB drives and others. Right. I must protect data carried via media, whether on paper or digital, from...Okay. What does this require? It requires that anyone accessing this information must
Speaker A
be authorized and identified. What else is required? It requires that for media like flash drives or paper, there must be a way to wipe the data completely.
Speaker A
Right. For paper, I destroy it. Some say, I'll take the paper and erase the middle. Right. They tear it into two pieces and say they've destroyed it.
Speaker A
That is wrong. Complete destruction of papers is done via machines that shred the paper into uniform pieces in shape and size. Very small pieces, perfectly uniform in shape and size. Why? Because any paper I shred from the middle,
Speaker A
someone could come along, and if they knew the paper was important, they could piece it back together and figure out what the basis of that document was . This actually happened in the archives of Nazi Germany after World
Speaker A
War II; they tried to destroy records by shredding them, but certain companies or entities took over the archives. And by reassembling the papers, using some form of artificial intelligence. They arranged the pieces side by side, after, of course,
Speaker A
scanning all the paper scraps that were there. So that the model was reconstructed in its...what? In its original form, just as it was originally. And they were able to read the data that was in the document. So, I need to get rid of it. Destroy. Get
Speaker A
rid of it for real, in a genuine way. The second thing is what they call sanitizing or wiping. What does wiping or sanitizing mean? Let’s say I have a flash drive. If I say I formatted the flash drive and went on my way. Did I
Speaker A
actually delete the data on the flash drive? Simply put, you just deleted the pointer to the data stored on the flash drive. But the data, you just deleted ...The pointer is gone, but the data actually remains on the flash drive. If
Speaker A
someone comes along and uses any data recovery software, they can read the data there, start piecing it together, identify the beginning and end of files , and know the contents of the flash drive or hard drive. I need to perform
Speaker A
a wiping operation. What does a wiping operation mean? It means I have to overwrite the flash drive. We have, for example, a program called BCWipe. What does this program do? Simply put, it overwrites your flash drive or hard
Speaker A
drive seven times in the same spot, and as a result, what happens? It writes everything as zeros, then all ones.
Speaker A
Then all zeros, then all ones, seven consecutive times. In this case, the possibility of recovering the data on the flash drive is eliminated.
Speaker A
Therefore, I must protect my data. It should have a password; it should be encrypted. Even if it doesn’t have a password, even after it has a password, it should be encrypted. When I want to get rid of the data we have, I must
Speaker A
wipe it. Or, for paper, I must destroy it. I should burn it, or what should I do? Or I should shred the paper regularly using one of those paper shredders. Into very small, uniformly edged pieces, so that it becomes
Speaker A
difficult or impossible to reassemble and identify them again. Okay, and what about physical and environmental protection? Physical protection, and the, what is physical protection? It means I have physical components, which is simply the hardware we have for any
Speaker A
system I’m running data on. Don't I need to have a server? The server is there, which is essentially hardware.
Speaker A
It consists of a hard drive, RAM, and a CPU. Okay, I need to protect these things. Okay, another thing, how do I protect them? It says to protect these things, I need to put a lock on the door. I want to give you an
Speaker A
identification card for the person coming to visit us, so they can access our system. All right, secondly, any unauthorized person is prohibited from entering. I want to add a third thing, which is having surveillance cameras.
Speaker A
What about surveillance cameras? They monitor every move taking place in the area and protect the site. So, I want to restrict access to the devices and equipment we have. Even if data access occurs, it should be limited to
Speaker A
authorized personnel only. I must have constant monitoring systems for the place where servers and data-related devices are kept. Understood. Okay, and another thing, who is this protection against? Against human interference.
Speaker A
All right, what other kind of protection do I have? Against environmental hazards. Right, I need to consider locations; for example, if I'm in a country prone to earthquakes.
Speaker A
Would it make sense to place the server in a spot unprotected from earthquakes? Not at all, I must place it in a location protected from earthquakes.
Speaker A
Secondly, I need to have backup plans or copies of my system and the data I have, so if an earthquake or a problem occurs in the area, and heaven forbid the protection plan fails, what do I do then? Tell me, in this case, who do I
Speaker A
turn to? To Plan B, and start working based on that. All right. Okay. Requirement number 12 is planning. We have encountered planning before. Now it appears as a separate item. What does planning involve? It means I must develop and periodically document any
Speaker A
operations occurring in our system. My security plan must be continuously developed. It must be constantly documented. It must be continuously updated. So that I am always up to date and capable of facing and challenging any problems arising in our system.
Speaker A
Understood. Okay, what should our security plan contain? It must contain two or three essential things. The first thing is the security measures currently implemented. Understood. And the things I might implement in the future. Also, codes of conduct for
Speaker A
every person in our system. There are people whose codes of conduct differ from one person to another, right. And therefore...The nature of people varies from one to another. So I must establish strict codes of conduct for whom? For all the people who will
Speaker A
access our system. Personnel security is perhaps one of the most dangerous problems we face. Understood. Where does the greatest danger come from?
Speaker A
From mistakes by people inside our system, whether intentional or unintentional. Any person should only have the minimum privileges necessary to access our system. That is one thing . Another thing is to say that all people inside the system must be...
Speaker A
Trusted individuals within our system, who meet the minimum security standards we have. Why? Because an untrustworthy person could actually cause a flaw or a problem for me. In terms of me being able to track the actions of, say, a
Speaker A
certain person. But if I have someone untrustworthy, how do I know if they could trick X, or find out X's ID and access our system? You must have a trusted team or staff working with you.
Speaker A
There is another thing, if this staff member moves from place to place in my organization, or their contract is terminated, I must have set procedures for handling the situation. Simply put, if I terminate this person's contract.
Speaker A
Within my organization, they might take retaliatory actions against the company , so I must have a ready plan; as soon as, or shortly before, terminating their contract, all their permissions must be revoked and their IDs within the organization disabled. Another
Speaker A
thing: moving them from one department to another, like from Finance to Payroll, or vice versa. In this case, I must also have an immediate mechanism to handle the permissions this person had. For the data that this person had
Speaker A
access to. So that if they decide to retaliate against the organization, the damage is as minimal as possible. Right . Formal sanctions. We must have formal penalties. For anyone who fails to comply with our existing policies and procedures. Right. Anyone who does not
Speaker A
comply with our procedures and rules. There will be formal penalties imposed on them. Standard number. 14, or requirement number 14, Risk Assessment.
Speaker A
I must conduct a continuous assessment of what? Of risk. We mentioned this before. I must conduct a continuous assessment. What is the point of a continuous assessment? It always gives me a picture of the current situation.
Speaker A
And the picture it gives me of the current situation results in. Changes to processing operations. Or storage operations. Or data transmission operations. Okay, standard number 15, Systems and Services. Acquisition. As an organization, do I have one system I'm working on? Or do I have more than
Speaker A
one system? I have more than one system . Do I have one service I provide? Or do I have more than one? I have more than one. And do I have one service from a third party or more? I also have
Speaker A
more than one. So what is required of me? I am required to identify, who is, sufficient security resources. What does sufficient mean? Adequate and enough for whom? I must have data security resources. Adequate and enough , right. They must be in place. The
Speaker A
person I have. In the organization and system development process must have the necessary and sufficient security knowledge; the software I buy, I must know how to use it. How to install it.
Speaker A
And what our basic requirements are? The second thing, anything taken from a third party or an external company must apply the minimum, or let's say apply the maximum or the acceptable level of security measures. I need this to
Speaker A
protect the information and systems I have; alright, are things clear? The penultimate standard, or the penultimate requirement, is the System and Communication Protection requirement. I have any program in the organization or any data in the organization; it must either be
Speaker A
directed to an internal system or directed to an external system. In case it is meant only for people inside the organization, like employee salaries, it's not right for someone from outside the organization to see it. This is placed in a zone called the
Speaker A
Demilitarized Zone (DMZ), a protected zone. Anyone coming from outside the internet, from outside our internal network, I want to prevent them from reaching this zone. Well, inside the organization, or rather, I bring them into this zone, the DMZ, and I prevent
Speaker A
them from entering the internal network of the organization. Now, let's come to another point: if I have internal access within my organization, do all people have the same authority to access its internal data, or do I say no? We also have another boundary for
Speaker A
data within the organization. Not all people can access the same data. How do we build this boundary? I could perform segmentation. Segment the network. Here is a network. The payroll department network. This is the academic affairs department network. This is, for
Speaker A
example, the student network. I can also implement access control lists. I am inside the payroll department. You are allowed to enter one or two. No, for academic affairs, it is allowed.
Speaker A
One. Two. Three, but you are not allowed X and Y. Alright. Okay, the organization should monitor, control, and protect communications. It must regulate. Monitor and protect our existing communications. What is meant by communications? Any process of sending or receiving data is what I
Speaker A
call communications, including external scenarios. We said, which are the ones coming through the internet. So we create a DMZ with the data they need.
Speaker A
And we prevent them from entering anywhere else within the network. Alright. Now, internal access, we talked about it. That this is specific to whom? To the internal employees. Not all of them are allowed to access all the data we have. Well, is everything
Speaker A
clear? I hope it is clear. Okay, the last standard or requirement is System and Information Integrity. It says every organization must identify and correct the data we have in the organization. Any attempted breach or attempted exploitation of our system
Speaker A
must be identified. And a report must be created about it. And provide accurate information about the attempted breach in a timely manner or as soon as possible. So that appropriate decisions can be made by the appropriate authorities. Okay, the
Speaker A
protection must be against malicious code. I might have code written that has a problem. So I must be able to locate it and. Inform the organization or our system personnel responsible for this to resolve it. Or, if I am a
Speaker A
person authorized to resolve it, I handle the solution myself. Well, our procedures can be divided into technical procedures and administrative procedures. Technical procedures are related to hardware and software. Or hardware and software together.
Speaker A
Administrative procedures can be described as those related to management. And they are the policies we have in our organizations. The 17 functional requirements we had can be divided into technical, management, or overlapping controls. For example, technical system classification. And
Speaker A
non-technical, such as who will raise employee awareness. Who will train them . That is management, right. It is basically management, administrative procedures, not technical procedures.
Speaker A
We have overlaps like configuration management systems. Media protection is a combination of technical and management, which are countermeasures.
Speaker A
Well, in this section, we talked about the functional requirements. There are 17 of them. They were defined in the FIPS 200 standard, and their mission is to protect confidentiality, integrity, and availability. We wanted to talk about something. Computer security is
Speaker A
not just a hardware or software problem , okay. It is not just a hardware or software issue. It is an integrated organization. The problem could be software. It could be hardware. It could be software and hardware together . It might need administrative or human
Speaker A
procedures to solve the issue. In the next section, God willing, we will talk about Security design. Thank you very much.
Topics:security functional requirementsFIPS 200access controlaudit and accountabilitycontingency planningidentification and authenticationnetwork securityincident responseconfiguration managementcomputer security course
