Annex II: Basic Security Principles All stakeholders must understand the procedures for protecting Internet infrastructure assets and handling the different types of threats and weaknesses that might have an impact on the security of an organization or a country at large. a. Basic Protection Principles Once assets are identified and their vulnerabilities assessed, protection has four stages: defence/prevention, detection, reaction, and deterrence. • Prevention refers to taking measures to prevent the attack. • Detection requires developing and implementing appropriate mechanisms to quickly identify the occurrence of a security event. • Response means developing and implementing the appropriate actions necessary to thwart and possibly contain a detected security event. • Deterrence increases and signals the costs of breaking into a system, keeping potential intruders from even trying due to the very low probability of successfully breaking into the system relative to the very high costs of doing so. b. Least Privilege Principle The principle of least privilege requires that a particular user be given no more privilege to perform actions or access information than is necessary to perform their function or job. Moreover, the principle also dictates that users use the lowest level of their privileges whenever possible. c. Defence in Depth Principle No single security control can protect an organization. Defence in depth is a layered approach to address or protect against threats, or to reduce vulnerability. For instance, perimeter security controls such as firewalls, intrusion detection/prevention systems or network access controls should be complemented with endpoint security controls such as anti-malware and host intrusion detection systems. The use of layered and complementary controls will increase the effort an attacker must expend to successfully attack the system, offering deterrence. 30 Internet Infrastructure Security Guidelines for Africa internetsociety.org