Computer Literacy Chapter_1_Unit1_2022.ppt

Computer word notes

1. Introduction to the Management of Information Security Chapter 1 Support Services II

2. Unit 1

3. Objectives Key characteristics of information security Dominant categories of threats in information security

4. Key Terms Asset An organizational resource that is being protected. Can be logical (website, software information or data) Can be physical (person, computer system, hardware, or any other tangible object) Assets, particularly information assets are the focus of security efforts Information asset The focus of information security, information that has value to the organization, systems that store, process and transmit that data

5. Introduction Organization must realize that info.sec . planning and funding decisions involve more than managers IT managers, Info.Sec department, IS Managers. The entire organization must be involved as represented by three distinct groups of communities of interest: Information security managers and professionals Information technology managers and professionals Non-technical business managers and professionals

6. Introduction… InfoSec community Protects the organization’s information assets from the threats they face. IT community Supports the business objectives of the organization by supplying and supporting information technology appropriate to the business needs Non-technical general business community Articulates and communicates organizational policy and objectives and allocates resources to the other groups

7. What Is Security? Definitions Security means to be free from danger. To be protected from risk of loss, damage, unwanted modification or other hazards. Security is often achieved by means of several strategies undertaken simultaneously or used in combination with one another. Specialized areas of security Physical security, Operations security, Communications security and Network security

8. What Is Security?... Information security focuses on the protection of information and the characteristics that give it value: Confidentiality, Integrity and Availability) Including the systems and hardware that use, store, and transmit that information Through the application of policy, technology, and training and awareness programs Policy, training and awareness programs and technology are vital concepts

9. What Is Security?... Components of InfoSec. Confidentiality – Integrity – Availability

10. CNSS Security Model…

11. CNSS Security Model… To better understand the management of InfoSec., you must be familiar with the key characteristics of information as expressed in the C.I.A. triad Confidentiality, Integrity and Availability These 3 alone are not enough nowadays, which calls for a more robust model that includes Privacy Identification Authentication Authorization Accountability

12. Key Concepts of Information Security Confidentiality The characteristic of information whereby only those with sufficient privileges may access certain information Measures used to protect confidentiality Information classification Secure document storage Application of general security policies Education of information custodians and end users

13. Key Concepts of Information Security… Integrity The quality or state of being whole, complete, and uncorrupted Information integrity is threatened If exposed to corruption, damage, destruction, or other disruption of its authentic state Corruption can occur while information is being compiled, stored, or transmitted

14. Key Concepts of Information Security… Availability The characteristic of information that enables user access to information in a required format, without interference or obstruction A user in this definition may be either a person or another computer system Availability does not imply that the information is accessible to any user Implies availability to authorized users

15. Key Concepts of Information Security… Privacy Information collected, used, and stored by an organization is to be used only for the purposes stated to the data owner at the time it was collected Privacy as a characteristic of information does not signify freedom from observation Means that information will be used only in ways known to the person providing it

16. Key Concepts of Information Security… Identification An information system possesses the characteristic of identification when it is able to recognize individual users Identification and authentication are essential to establishing the level of access or authorization that an individual is granted Authentication Occurs when a control proves that a user possesses the identity that he or she claims

17. Key Concepts of Information Security… Authorization Assures that the user has been specifically and explicitly authorized by the proper authority to access, update, or delete the contents of an information asset User may be a person or a computer Authorization occurs after authentication

18. Key Concepts of Information Security… Accountability Exists when a control provides assurance that every activity undertaken can be attributed to a named person or automated process

19. Key Concepts of Information Security… Key terms: Attack : Intentional/unintentional act that can damage or otherwise compromise information and systems that support it. Exploit : A technique used to compromise a system. Loss : A single instance of information asset suffering damage or destruction, unintended or unauthorized modification or disclosure, or denial of use. Threat : Any event or circumstance that has the potential to adversely affect operations and assets. Threat agent : The specific instance or component of a threat. Threat event : Same as attack Vulnerability : A potential weakness in an asset or its defensive control system(s)

20. Categories of Threats

21. Categories of Threats

22. Categories of Threats

23. Categories of Threats

24. Categories of Threats

25. Categories of Threats

26. Categories of Threats

27. Categories of Threats

28. Categories of Threats

29. Categories of Threats

30. Summary… What is Security What is Management Principles of Information Security Management

31. End of Unit 1