Section 1: Governance Elements

Every organization exist for a purpose and to achieve it goals, decisions are made, rules and practices are defined and policies and procedures must be in place to guide the organization achieved its goal
When managemnt implement Systems and Structure that the organization will used to to achieved its goals, they are guided by laws and and regulations created by the Government to enact public policy.
Laws and regulations guide the development of standards, which cultivate policies, which results in procedures

How regulations, Standard, Polices and procedures are inter connected:

1. Procedures are the detailed steps to complete a task that support departmental or organizational policies

2. Policies are put in place by organizational governance, such as executive management, to provide guidance in all activities to ensure that the organization supports industry standards and regulations. Functional areas such as human resources management, finance and accounting, and security and asset protection usually have their own sets of policies.

3.Standards are often used by governance teams to provide a framework to introduce policies and procedures in support of regulations.
Standards cover a broad range of issues and ideas and may provide assurance that an organization is operating with policies and procedures that support regulations and widely accepted best practices

Example: The International Organization for Standardization (ISO) develops and publishes international standards on a variety of technical subjects, including information systems and information security, as well as encryption standards.
The National Institute of Standards and Technology (NIST) is a United States government agency under the Department of Commerce and publishes a variety of technical standards in addition to information technology and information security standards.
The Institute of Electrical and Electronics Engineers (IEEE) also sets standards for telecommunications, computer engineering, and similar disciplines.

4.Regulations are commonly issued in the form of laws, usually from government (not to be confused with governance) and typically carry financial penalties for non-compliance.
Example: The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a law that governs the use of protected health information (PHI) in the United States. Violation of HIPAA carries the possibility of fines and/or imprisonment for both individuals and companies.

Section 2: Security Controls

Security controls pertain to the physical, technical, and administrative mechanisms that act as safeguards or countermeasures to protect the confidentiality, integrity, and availability of the system and its information.

1. Physical Controls
Physical controls address security needs using physical hardware devices, such as badge readers, architectural features of buildings and facilities, and specific security actions taken by staff. Physical controls are supported by technical controls as a means of incorporating them into an overall security system
for example, most cooperate building use physical controls to identify who get access into it facilities

2. Technical Controls
Technical controls (also called logical controls) are security controls that computer systems and networks directly implement. These controls can provide automated protection from unauthorized access or misuse, facilitate detection of security violations, and support security requirements for applications and data

3. Administrative Controls
Administrative controls (also known as managerial controls) are directives, guidelines, or advisories aimed at the people within the organization. They provide frameworks, constraints, and standards for human behavior and usually cover the entire scope of the organization’s activities and its interactions with external parties and stakeholders. Administrative control can be powerful, effective tools for achieving information security

Section 3: Risk Priorities

Organization Priorities risk after they have been identified. Risk can be Priorities and analyze through qualitave Risk analysis and/ or quantitative risk analysis.
Understanding the organization’s overall mission and the functions that support the mission helps to place risks in context, determine the root causes, and prioritize the assessment and analysis of these items.
Most Organization uses risk matrix method to prioritize risk. This method helps identify priority as the intersection of likelihood of occurrence and impact.

Solution

Fundamentals of Virtualization

Virtualization is a technology that you can use to create virtual representations of servers, storage, networks, and other physical machines. Virtual software mimics the functions of physical hardware to run multiple virtual machines simultaneously on a single physical machine.

Virtualization is a process that allows a computer to share its hardware resources with multiple digitally separated environments. Each virtualized environment runs within its allocated resources, such as memory, processing power, and storage. With virtualization, organizations can switch between different operating systems on the same server without rebooting.
Some examples of virtualization software are; VMware, Virtualbox .........

Virtual machines and hypervisors are two important concepts in virtualization.

Virtual machine
A virtual machine is a software-defined computer that runs on a physical computer with a separate operating system and computing resources. The physical computer is called the host machine and virtual machines are guest machines. Multiple virtual machines can run on a single physical machine. Virtual machines are abstracted from the computer hardware by a hypervisor.

Figure 1:Structure of Virtual machine

Hypervisor
The hypervisor is a software component that manages multiple virtual machines in a computer. It ensures that each virtual machine gets the allocated resources and does not interfere with the operation of other virtual machines. There are two types of hypervisors.

Type 1 hypervisor
A type 1 hypervisor, or bare-metal hypervisor, is a hypervisor program installed directly on the computer’s hardware instead of the operating system. Therefore, type 1 hypervisors have better performance and are commonly used by enterprise applications. KVM uses the type 1 hypervisor to host multiple virtual machines on the Linux operating system.

Type 2 hypervisor
Also known as a hosted hypervisor, the type 2 hypervisor is installed on an operating system. Type 2 hypervisors are suitable for end-user computing.

Among the numerious virtualization software out there, we have choosen to work with VirtualBox. you can learn more about this software by clicking the following link
http://virtualbox.org
Oracle VM VirtualBox
We could have as well create and account with any cloud provider and lunche an instance in the cloud but at the end of it, we will have to encure some cost. You can go ahead with that if you choose to.

What Is VirtualBox?

VirtualBox is a program that allows you to install and run various operating systems (OS) inside your existing operating system using the concept of virtual machines. As the name suggests, a VM is a virtual computer that can run programs and operating systems. Think of it as a computer within a computer. Here are some the features and benefit of virtualbox

Free to download and easy to install.
Runs on Windows, Mac, and Linux.
Perfect for our purpose.
Provides full virtualization.
Creates virtual machines.
Guest OS thinks it's using real hardware.
Allows the guest to access shared folders on the (if you configure them).
Allows for shared clipboards (if you enable them).
Better video performance.
more.....

Click on the link, learn, install virtualbox and a linux OS on it. Install linux on Oracle VirtualBox
If you go through the manuall process of installing linux on virtualbox, you will realized that it time consumming. if you have 10 linux OS to install on virtualbox, the process will have to take a couple of minutes or hours. SO let's Automate it by bringing in a command online tool call VAGRANT

What is Vagrant?

Vagrant is an open-source tool that helps us to automate the creation and management of Virtual Machines. In a nutshell, we can specify the configuration of a virtual machine in a simple configuration file, and Vagrant creates the same Virtual machine using just one simple command. It provides command-line interfaces to automate such tasks.
You can read more about vigrant here VAGRANT

Terminologies and fundamentals Of Vagrant

Vagrant boxes

The basic unit of Vagrant setup is Vagrant Box. Just like Docker Image, Vagrant Box is a self-contained image of the Operating System. More specifically, it is a packaged Virtual Machine. Instead of building a virtual machine from scratch, which would be a slow and tedious process, Vagrant uses a base image to quickly clone a virtual machine. These base images are known as "boxes" in Vagrant, and specifying the box to use for your Vagrant environment is always the first step after creating a new Vagrantfile.,

The vagrant box is a ready-made base image (Operating System Image) of a Virtual Machine Environment.
You can use a box on any supported platform to bring up identical working environments. To enable teams to use and manage the same boxes, versions are supported.
The quickest way to get started is to select a pre-defined box environment from the publicly available catalog on Vagrant Cloud.You can also add and share your own customized boxes on Vagrant Cloud.
The publicly catalog on Vagrant Cloud contains most major operating systems as bases, as well as specialized boxes to get you started with common configurations such as LAMP stacks, Ruby, and Python.
Note:Boxes require a provider, a virtualization product, to operate. Before you can use a box, ensure that you have properly installed a supported provider. While Vagrant ships out of the box with support for VirtualBox, Hyper-V, and Docker, Vagrant has the ability to manage other types of machines as well. For example, if you are using Vagrant for any real work, VMware providers are recommended since they're well supported and generally more stable and performant than VirtualBox.

Install a Box (Optional)

When you initiate a Vagrant project with the command: vagrant init username/box name, a box is added and a vagrantfile is automatically created or installed.

When you want to install a box without creating a new Vagrantfile, you will have use the box add subcommand.

You can add a box to Vagrant with vagrant box add. This stores the box under a specific name so that multiple Vagrant environments can re-use it. When you run the add box command,

vagrant box add hashicorp/bionic64

Vagrant will prompt you to select a provider. Type 2 and press Enter to select Virtualbox. Note; if type virtualbox, you will recieve an error. picture seen below

Figure 3 vagrant box

The command download the box named hashicorp/bionic64 from HashiCorp's Vagrant Cloud box catalog, where you can find and host boxes.

Boxes are globally stored for the current user. Each project uses a box as an initial image to clone from, and never modifies the actual base image. This means that if you have two projects both using the hashicorp/bionic64 box you just added, adding files in one guest machine will have no effect on the other machine.

As earlier mention, you can add a box to Vagrant either by initializing or adding it explicitly. After successfully adding a box, you need to configure your project to use it as a base. Create your project folder or directory and in that directory, open a Vagrantfile and replace the contents with the following .

Vagrant.configure("2") do |config|
config.vm.box = "hashicorp/bionic64"
config.vm.box_version = "1.0.282"

Note:The hashicorp/bionic64 in this case must match the name you used to add the box above.

Vagrantfile

The primary function of the Vagrantfile is to describe the type of machine required for a project, and how to configure and provision these machines. Vagrantfiles are called Vagrantfiles because the actual literal filename for the file is Vagrantfile.
Vagrant is meant to run with one Vagrantfile per project, and the Vagrantfile is supposed to be committed to version control. This allows other developers involved in the project to check out the code, run vagrant up, and be on their way. Vagrantfiles are portable across every platform Vagrant supports.

Initialize a vagrant project

The first step to configure any Vagrant project is to create a Vagrantfile

Create a folder where you want to save all the Vagrant-related files. You can create such folder or directory with any command prompt tool (powershell for window or terminal for linux) by runing the command mkdir linuxclass
Move into the folder or directory in step 1 with the change directory command (cd linuxclass)
Now initialize the Vagrant project by runing vagrant init follow by the name of the box you have selected from the public catalog on Vagrant Cloud.

For example:

vagrant init generic/centos8
.
when you run this command, a Vagrantfile will be created in the current directory or folder and you will see and output like the one below.

Figure 2 vagrant initialization
when you open the Vagrantfile with any text editor of your choose, you will see important configuration like

Vagrant.configure("2") do |config|
config.vm.box = "generic/centos8" (This is the Vagrant Box, that was mentioned during initialization.)
You can edit the Vagrantfile and set the hostname of the virtual machine to "testup ". Also, assign the IP address of 10.23.45.80 to the machine. You can as well future config the file to meet up your app demand.

Your vagrantfile will now look like this; (Note:This is just part of the file)

Figure 3 vagrant configuration
Now you're ready to start the VM, test its network connectivity, and connect to it.
Run the command vagrant up
Vagrant will import the box into VirtualBox and start it. open virtualbox to confirm that a virtual machine is running in it

SSH into Virtual Machine

Now, the VM has been created. So, to get into it, run command vagrant ssh. After executing this command you are now inside the newly created VM. Now, anything can be done inside the VM through this terminal.

Note:Requires ssh client.
If you are a window user, you need to download Git from git-scm.com in order to be able to ssh into your machine. More on this in our next project.

To exit the machine run the command exit

Some important vagrant command and their functions are:

vagrant halt Stops the VM

vagrant up Starts the VM

vagrant suspend Suspends the VM

vagrant resume Resumes the VM

vagrant destroy Removes the VM (Note: The vagrant destroy command does not remove the downloaded box file.)

vagrant box remove username/box-name Remove the box

vagrant Shows your options

Solution

Fundamentals of Virtualization

boy
Figure 1:Structure of Virtual machine

Type 2 hypervisor
Also known as a hosted hypervisor, the type 2 hypervisor is installed on an operating system. Type 2 hypervisors are suitable for end-user computing.