introduction to information security management
DESCRIPTION
Information Security Management (INFS 5055) & Information Security Management (INFS 3070) Study Period 2, 2010. INTRODUCTION TO INFORMATION SECURITY MANAGEMENT. Today’s Reference: Whitman & Mattord, 2008, Management of Information Security, 2 nd edition Chapter 1 - PowerPoint PPT PresentationTRANSCRIPT
INTRODUCTION TO
INFORMATION SECURITYMANAGEMENT
Information Security Management (INFS 5055) &
Information Security Management (INFS 3070)
Study Period 2, 2010
Today’s Reference:
Whitman & Mattord, 2008, Management of Information Security, 2nd editionChapter 1(alternatively, 3rd edition is fine)
What is Security?
• “a well-informed sense of assurance that the information risks and controls are in balance.” —Jim Anderson, Inovant (2002)
• “The quality or state of being secure—to be free from danger”
• A successful organization should have multiple layers of security in place: – Physical security– Personal security – Operations security – Communications security – Network security– Information security
Physical Security
• commonly thought of as “building” security
• guns, dogs, guards, locks, infrared sensors, cameras, access card systems
• physical access systems
Personnel Security
• the most important asset (?)
• core of many security problems
• examples are:– pre-employment screening– security awareness training– exit interviews– employee contract– anti-fraud initiatives
What is Information Security?
• An Information System consists of:– hardware– software– IS people– data & information (in various forms)– procedures, processes, policies
• IS Security relates to all of these components
• Previously referred to as ‘Computer Security’
• Commonly referred to as ‘Information Security’
HARDWARE
SOFTWARE
PEOPLE DATA
DOCUMENTATION
PROCEDURES
VIRUSES
THEFT
FIRE
SOFTWARE BUGS
PHYSICALSABOTAGE
LOSS OF PEOPLE
FRAUD
HACKERS
INPUT ERROR
HARDWAREMALFUNCTION
UNAUTH.ACCESS
LOSS OFELECTRICITY
User ID’s &passwords
Pre-employmentscreening
Encryption
Powersupply
Segreg- ationof duties
Firedoors
Backup
Guns, dogs& guards
Policymanual
Softwarevalidation
Maintenancecontract
Locks
TELECOMMUNICATIONS
Information Security
Why is it important?
• Business survival could be at stake
• Management attitude is (still) “It won’t happen to me” – this needs to change
• Vulnerabilities are greater with advent of complex networks
• New threats are emerging as technology is embraced
• Attacks on systems are more prevalent
Security Breaches & Impacts
Critical Characteristics of Information
• The value of information comes from the characteristics it possesses: – Confidentiality
– Integrity
– Availability
– Privacy
– Identification
– Authentication
– Authorisation
– Accountability
Scope of Information Security
• IS Security relates to minimising the threats to the Availability, Integrity and Confidentiality of information (and the Authenticity)
• Availability– disruptions
• Environmental (e.g. airconditioning or power failure)
• hardware breakdowns
– disasters• natural disasters (flood, fire,
earthquake)• other disasters (war, terrorism)• software bugs
– catastrophic failure• human safety compromised
– logical or physical– accidental or deliberate
• Integrity– errors & omissions– computer crime – hackers
• Confidentiality– loss of print-out report
(physical/accidental)– loss of message, misdirected
message (logical/accidental)– theft of PC, screen snooping
(physical/deliberate)– wiretapping, hacking, electro
magnetic radiation (logical/deliberate)
Principles Of Information Security Management
• The extended characteristics of information security are known as the six Ps:– Planning– Policy– Programs– Protection– People– Project Management
Planning
• Several types of InfoSec plans exist:– Incident response– Business continuity– Disaster recovery– Policy– Personnel– Technology rollout – Risk management – Security program including
education, training, and awareness
Policy
• The set of organizational guidelines that dictates certain behavior within the organization is called policy
• In InfoSec, there are three general categories of policy: – General program policy
(Enterprise Security Policy)– An issue-specific security policy
(ISSP) – System-specific policies (SSSPs)
Programs
• Specific entities managed in the information security domain
• A security education training and awareness (SETA) program is one such entity
• Other programs that may emerge include a physical security program, complete with fire, physical access, gates, guards, and so on
Protection
• Risk management activities, including risk assessment and control, as well as protection mechanisms, technologies, and tools
• Each of these mechanisms represents some aspect of the management of specific controls in the overall information security plan
People
• People are the most critical link in the information security program
• It is imperative that managers continuously recognize the crucial role that people play
• Including information security personnel and the security of personnel
Project Management
• Project management discipline should be present throughout all elements of the information security program
• This effort involves identifying and controlling the resources applied to the project, as well as measuring progress and adjusting the process as progress is made toward the goal
THREATS
ASSETS
RISKS
CONTROLS
The Sequence
threaten
which create
Which require
Vulnerability? Risk Exposure?Countermeasures?
“Health & Safety” of a person
• Threats– Heart attack, stroke, car accident– Work accident, sporting injury,
assault– Disease
• Assets– Tissue, brain, heart, mind, limbs– Organs, eyes, skin, self-esteem
• Risks– Death, injury, loss of limb, sickness– Brain damage, loss of eyesight
• Controls– Regular exercise, proper food – OH & S procedures at work– Safe sports, safe driving, – Regular doctor check-ups– Minimal stress, adequate sleep
Threats
• Something that has the potential to cause harm or loss
• 4 classes– interruption
• hardware breakdown, software bug, operators on strike
– interception• wiretapping, hacking
– modification and fabrication• Hackers tampering with &
changing data
• adding records or transactions
• 1. Errors & omissions• 2. Data network breakdowns• 3. Software errors & omissions• 4. Computer-based fraud• 5. Accidental & natural disasters• 6. Equipment failure• 7. Unauthorised access• 8. Deliberate destruction of
equipment• 9. Misuse of computing
equipment• 10. Theft of computers
Top 10 Threats in IS
Risks
• Risk of going out of business
• Risk of losing competitive advantage
• Risk of unauthorised access
• Risk of being sued
• Risk of embarrassment
• Risk of losing money
• Risk of losing customers
Vulnerabilities
• A weakness in the security of the system which might be exploited to cause loss or harm
Controls/ Countermeasures
• 4 categories– Management– Hardware– Software– Authentication
Management Controls
• Security policies
• Segregation of duties
• Awareness training
• Physical security procedures
• Operational controls and procedures
• Exit Interviews
• New employee screening
• Personnel security
Hardware Controls
• Environmental conditions
• O/S controls
• Silicone, plastic, tin
Software Controls
• Access control software (RACF, ACF2, etc)
• Programming standards– range checks– check digits– modular programs
• Change control procedures
• Authorisation controls
Authentication Controls
• passwords
• PINs
• smart cards
• biometric devices
• something user knows
• something user has
• something user is
• something user can do
• someplace user is
• 1. IS security policy document• 2. Allocation of security responsibilities• 3. IS security education & training• 4. Reporting of security incidents• 5. Virus control• 6. Business continuity planning• 7. Control of proprietary copying• 8. Safeguarding of company records• 9. Compliance with data protection
legislation• 10. Compliance with security policy
Top 10 Controls
What you need to know!
• What is InfoSec and why it’s important
• Scope of InfoSec
• Principles of InfoSec Management
• A general idea of Threats, Risks and Controls