* Symmetric Cryptography:
* Definition: Uses a single key for both encryption and decryption.
* Speed: Typically faster than asymmetric cryptography due to simpler mathematical operations.
* Use Cases: Suitable for encrypting large amounts of data, such as in file encryption.
* Asymmetric Cryptography:
* Definition: Uses a pair of keys - a public key for encryption and a private key for decryption.
* Speed: Generally slower than symmetric cryptography due to more complex mathematical operations.
* Use Cases: Ideal for secure key exchange, digital signatures, and encrypting small amounts of data.
* NIST SP 800-57: Provides guidelines on key management, highlighting the differences in speed and use cases between symmetric and asymmetric cryptography.
* ISO/IEC 18033-1: Specifies cryptographic algorithms and outlines the performance characteristics of symmetric and asymmetric cryptography.
Cybersecurity References:Symmetric cryptography is faster than asymmetric cryptography, making the statement about symmetric cryptography being up to 10,000 times slower incorrect.

The primary objective of Distributed Denial of Service (DDoS) attacks is to disrupt the availability of systems and data. DDoS attacks overwhelm the targeted system with a flood of traffic, rendering it inaccessible to legitimate users. This disruption of availability can cause significant operational and financial damage to organizations.
References:
* NIST SP 800-61- Computer Security Incident Handling Guide, which outlines the nature of DDoS attacks and their impact on system availability.
* ISO/IEC 27002:2013- Provides best practices for information security management, including measures to protect against DDoS attacks.

A cyber threat related to system configurations and environments includes the risk posed by systems or services being publicly accessible through the internet. Public accessibility increases the attack surface and exposes the system to potential cyber threats.
* Public Accessibility:
* Definition: Systems or services that can be accessed from the internet by anyone.
* Risks: Increases exposure to attacks such as unauthorized access, DDoS attacks, and exploitation
* of vulnerabilities.
* System Configuration and Environment:
* Vulnerabilities: Poor configuration, lack of updates, and inadequate security measures can increase risks.
* Mitigation: Implementing firewalls, access controls, and regular security audits can help mitigate these threats.
* ISO/IEC 27001: Emphasizes the importance of securing system configurations and managing public accessibility to mitigate risks.
* NIST SP 800-53: Recommends controls to protect publicly accessible systems, including access controls and continuous monitoring.
Detailed Explanation:Cybersecurity References:By ensuring that systems are not unnecessarily publicly accessible, organizations can reduce their exposure to cyber threats.

Sarah should use Platform as a Service (PaaS) to deploy her custom applications using programming languages, libraries, and tools supported by a cloud provider without worrying about managing the underlying infrastructure.
* Platform as a Service (PaaS):
* Definition: A cloud computing service that provides a platform allowing customers to develop, run, and manage applications without dealing with the infrastructure.
* Benefits: Simplifies the development process by providing essential tools, databases, and middleware.
* PaaS Features:
* Development Tools: Offers programming languages, libraries, and frameworks for application development.
* Infrastructure Management: The cloud provider manages the underlying hardware and software infrastructure.
* Scalability: Allows easy scaling of applications as needed without managing servers.
* ISO/IEC 17788: Defines cloud computing services, including PaaS, and outlines their characteristics and benefits.
* NIST SP 800-145: Provides a definition of cloud computing services and details the different service models, including PaaS.
Detailed Explanation:Cybersecurity References:By using PaaS, Sarah can focus on developing and deploying her applications without the complexities of managing the infrastructure.

The principle of developing, implementing, and improving a comprehensive cyber strategy highlights the importance of regularly assessing the performance of cyber controls. This principle ensures that the organization continuously monitors and enhances its cybersecurity measures to address new threats and vulnerabilities effectively.
Regular assessment of cyber controls is crucial for maintaining an effective security posture. It involves evaluating the effectiveness of existing controls, identifying gaps, and implementing improvements. This approach aligns with the principle of continual improvement and ensures that the cybersecurity strategy remains relevant and robust.
References:
* ISO/IEC 27001:2013- Encourages regular assessment and improvement of the ISMS to ensure its ongoing effectiveness.
* NIST Cybersecurity Framework (CSF)- Emphasizes the importance of continuous monitoring and improvement as part of a comprehensive cybersecurity strategy.
By regularly assessing and improving cyber controls, organizations can enhance their resilience against cyber threats and ensure the effectiveness of their cybersecurity measures.