chp1- Information Security Overview.pptx

Information Security Overview

1. DFP40263 Secure Mobile Computing Topic 1 Information Security Overview

2. 1.1 THE NEED FOR INFORMATION SECURITY What Is Information Security? The protection of information and its critical elements, including the systems and hardware that use, store and transmit that information. the entire set of software, hardware, database, people, and procedures necessary to use information as a resource in the organization

3. WHY NEED INFORMATION SECURITY? Prevent unauthorized access to the network that is potential threat to the network and its resources. Ensure that the authentic users can effectively access the network and its services. Applications that can protect the network from unauthorized access are in place. ( eg : Antivirus)

4. Characteristics of Information Security Making sure that those who should not see information Making sure that the information has not been changed from its original Making sure that the information is available for use when you need it The C.I.A. triangle was the standard based on confidentiality, integrity, and availability CIA TRIAD

5. 1.1.2 Characteristics of IS – CIA TRIAD a. Confidentiality (C) Confidentiality is the protection of personal information. It maintain the privacy of data. It means keeping a client’s information between you and the client, and not telling others including co-workers, friends, family, etc. Eg: ATM (Auto Teller Machine) pin number stolen by someone else.

6. b. Integrity (I) protecting information from being modified by unauthorized parties. trustworthiness of information resources. assurance that data is genuine Information needs to be changed constantly. Integrity means that changes need to be done only by authorized entities and through authorized mechanisms.

7. c. Availability (A) the information must be available when it is needed. system still functions efficiently after security provisions are in place The information created and stored by an organization needs to be available to authorized entities 24x7. Information needs to be constantly changed, which means it must be accessible to authorized entities.

8. 1.1.3 APPLY THE CHARACTERISTICS OF CIA IN REAL ENVIRONMENT

9. 1.1.4 SECURITY MODELS Open Security Models - terbuka Restrictive Security Models - terhad Closed Security Models - tertutup

10. a. OPEN SECURITY MODELS The easiest to implement. Simple password and server security becomes the foundation of this model. This model assumes that the protected assets are minimal , user are trusted , and threats are minimal. LAN are NOT connected to the Internet. If security breaches occurs, the result will be in great damage or loss.

11. a. OPEN SECURITY MODELS

12. b. RESTRICTIVE SECURITY MODELS More difficult to implement. Firewalls and identity servers become the foundation of this model. This model assumes that the protected assets are substantial ( utama ) , some users are NOT trustworthy, and that threats are likely. Suitable for LANs/public WANs that connect to the Internet. Ease of use for users diminishes ( berkurangan ) as security tightens.

13. CON’T… b. RESTRICTIVE SECURITY MODELS

14. c. CLOSED SECURITY MODELS Most difficult to implement. All available security measures are implement in this design. This model assumes that the protected assets are premium, all users are NOT trustworthy, and that threats are frequent. User access is difficult and cumbersome ( rumit ) . Need many train network administrator to maintain the tight security applied.

15. CON’T… c. CLOSED SECURITY MODELS

16. Categories of Risks Sec 1.2 Potential risk to Information urity Physical damage - Fire, water, vandalism, power loss, and natural disasters. Human interaction - Accidental or intentional action or inaction that can disrupt productivity. Equipment malfunction - Failure of systems and peripheral devices. Inside and outside attacks - Hacking, cracking, and attacking Misuse of data- Sharing trade secrets, fraud, espionage, and theft. Loss of data - Intentional or unintentional loss of information through destructive means. Application error - Computation errors, input errors, and buffer overflows. Social Status - Loss of Customer base and reputation.

17. 1.2.1 THREATS TERMINOLOGY Information Theft Unauthorized Disclosure Information Warfare Accidental Data Loss Data Disclosure Data Modification Data Availability

18. Information Theft ( Kecurian maklumat) Get the private information (ID number/pin number/password) without any permission It is a form of stealing someone’s identity in which someone pretends to be someone else by assuming that person’s identity. Unauthorized Disclosure An event involving the exposure of information to entities not authorized access to the information That an organization suspects some of its employees leaking out the confidential information to its competitor. It is also usually believed that its competitor actually planted spies within the organization in order to target and steal new product plan.

19. c. Information Warfare May involve collection of tactical information to demoralize the enemy and the public d. Accidental Data Loss An error condition in information systems in which information is destroyed by failures or neglect in storage, transmission, or processing. Delete files unfortunately

20. e. Data Disclosure :- Pendedahan Data Voluntary sharing of any and all information that is considered relevant to a given situation. Eg: Data or information is opened to unauthorized persons, processes, or devices. Make data available without permission or authority. Data is stolen but owner still has it.

21. f. Data modification – Pengubahan Data Modify information that an attacker is not authorized to modify. Data is altered without authorization. Data can be modified in store or in transmission. Information source Information destination MODIFICATION Middle man

22. g. Data Availability - Ketersediaan Data Products and services that ensure that data continue to be available at a required level of performance in situations ranging from normal through “disastrous”. 24x7 available. Information source Information destination INTERRUPTION

23. END OF Chapter 1 Thank You