CW3351 Data and Information Security- Unit 1 Introduction.pdf

Topics to be covered
 History,
 Critical characteristics of information,
 NSTISSC security model,
 Components of an information system,
 Securing the components,
 Balancing security and access
 The SDLC: The security SDLC

1. CW3351 Data and Information Security
Unit 1 : Introduction
Dr. R.Perumalraja, Professor & Head
Department of Artificial Intelligence and Data Science, SRM TRP EC.
CW3351 Data and Information Security Unit 1 : Introduction

2. Topics to be covered
History,
Critical characteristics of information,
NSTISSC security model,
Components of an information system,
Securing the components,
Balancing security and access
The SDLC: The security SDLC
2
CW3351 Data and Information Security Unit 1 : Introduction

3. Objectives
Understand the definition of information security
Understand the critical characteristics of information
Understand the comprehensive model for information security
Outline the approaches to information security implementation
Outline the phases of the security systems development life cycle
Understand the key terms of information security
3
CW3351 Data and Information Security Unit 1 : Introduction

4. 4
The History of Information Security
Beganimmediatelyafterthefirstmainframesweredeveloped
Inthe1970s,thetruebirthofcybersecuritybeganduringWorld
WarIIwithaprojectcalledTheAdvancedResearchProjects
AgencyNetwork(ARPANET).
Physicalcontrolstolimitaccesstosensitivemilitarylocationsto
authorizedpersonnel
Rudimentaryindefendingagainstphysicaltheft,espionage,and
damage
Encryptionscramblesdatatomakeitunreadabletohackers.It
canoccuratmultiplelevels,notonlyprotectingnetworks,but
individualfilebothinstorageandduringdatatransmissions.
Datasecuritydescribestheprotectionofdigitaldatafroma
cyberattackoradatabreach..
CW3351 Data and Information Security Unit 1 : Introduction

5. The History of Information Security
A data breach is the unauthorized opening of data, typically to read
or copy the information
The Target Breach 2013 70-110 million customers data did
fraudulent transactions using credit cards $162 million
The Yahoo Breach in 2013, roughly $300,000 all 3 billion of
Yahoo’s email customers became victims of cybercrime
The 2015 Voter Database Breach A database, with the information
of 191 million voters, was exposed to the open internet in late
2015.
The Adult FriendFinderBreach mid-October of 2016, more than
412 million accounts
AugusteKerckhoffs, provided a foundation on all modern
cryptography is a father of computer security
5CW3351 Data and Information Security Unit 1 : Introduction

6. 6
What is Security?
“Thequalityorstateofbeingsecure—tobefreefromdanger”
Anorganizationshouldhavemultiplelayersofsecurity:
Physicalsecurity-ProductthePhysicalitems,objectorareasfrom
unauthorizedaccessandmisuse
Personalsecurity-Protectiontopersonalwhoauthorizedtoaccess
organizationanditsoperation
Operationssecurity-Protectionofthedetailsofparticularoperationor
activities
Communicationssecurity-Protectionoforganizationscommunication
media,technologyandcontent
Networksecurity-ProtectionofNetworkingComponents,Connections
andContents
Informationsecurity-ProtectionofinformationanditsCriticalelements
CW3351 Data and Information Security Unit 1 : Introduction

7. Why we use Information Security?
Information security is the practice of protecting information by
mitigating information risks. It involves the protection of
information systems and the information processed, stored and
transmitted by these systems from unauthorized access, use,
disclosure, disruption, modification or destruction.
Protecting sensitive information from being accessed, disclosed, or
modified by unauthorized individuals
Mitigating risk: associated with cyber threats and other security
incidents
Compliance with regulations
Protecting reputation: Security breaches can damage an
organization’s reputation and lead to lost business.
Ensuring business continuity includes maintaining access to key
systems and data, and minimizing the impact of any disruption
7CW3351 Data and Information Security Unit 1 : Introduction

8. 8
What is Information Security?
Thepracticeofdefendinginformationfromunauthorized
access,use,disclosure,disruption,modification,perusal,
inspection,recordingordestruction
Theprotectionofinformationanditscriticalelements,
includingsystemsandhardwarethatuse,store,andtransmit
thatinformation
Necessarytools:policy,awareness,training,education,
technology
C.I.A.trianglewasstandardbasedonconfidentiality,integrity,
andavailability
C.I.A.trianglenowexpandedintolistofcriticalcharacteristics
ofinformation
CW3351 Data and Information Security Unit 1 : Introduction

9. 9CW3351 Data and Information Security Unit 1 : Introduction
C.I.A. Triangle & Components
Components of an
Information System –
Software –Hardware –
Data –People –
Procedures –Networks

10. 10
Components of Information Security
CW3351 Data and Information Security Unit 1 : Introduction

11. 11
Critical Characteristics of Information
ThecharacteristicsofInfo.securitydefinedbyCIATriangle:
Availability:Enablesauthorizeduserstoaccessinformation
withoutobstructionandtoreceiveitintherequiredformat
Accuracy:Whenitisfreefrommistakesorerrorsandithasthe
valuethatuserexpects[BankBalance]
Authenticity:TheQualityorStateofbeinggenuineorOriginal,
ratherthanaReproductionorFabrication[Emailspoofing]
Confidentiality:Preventedfromthedisclosureorexposureto
unauthorizedindividualsorsystems[Salamitheft]
Integrity:ItisWhole,completeanduncorrupted[filehashing]
Utility:Thequalityorstateofhavingvalueforsomepurposeorend
Possession:Thequalityorstateofhavingownershiporcontrolof
someobjectoritem
CW3351 Data and Information Security Unit 1 : Introduction

12. NationalSecurityTelecommunications,andInformationSystemsSecurity
Committee
ModelforInformationSecurityandisbecomingEvaluationStandard
27Cellsrepresentingareasthatmustbeaddressednthesecurityprocess
Thecellsthatcanberepresentedare(1)Confidentiality,Integrity,
availability(2)Policy,Education,Technology(3)Storage,Processing,
Transmission
CW3351 Data and Information Security Unit 1 : Introduction
NSTISSC Security Model

13. 13
CW3351 Data and Information Security Unit 1 : Introduction
Approaches to Information Security
Implementation

14. 14
Approaches to Information Security
Implementation
Bottom-UpApproach
Grassrootseffort:systemsadministratorsattempttoimprove
securityoftheirsystems
Keyadvantage:technicalexpertiseofindividualadministrators
Seldomworks,asitlacksanumberofcriticalfeatures:
Participantsupport
Organizationalstayingpower
Top-DownApproach
Initiatedbyuppermanagement
Issuepolicy,proceduresandprocesses
Dictategoalsandexpectedoutcomesofproject
Determineaccountabilityforeachrequiredaction
Themostsuccessfulalsoinvolveformaldevelopmentstrategy
referredtoassystemsdevelopmentlifecycle

15. 15
The Security Systems Development Life Cycle
ThesamephasesusedintraditionalSDLCmaybeadaptedtosupport
specializedimplementationofanISproject
Identificationofspecificthreatsandcreatingcontrolstocounterthem
SecSDLCisacoherentprogramratherthanaseriesofrandom,seemingly
unconnectedactions
SDLC Waterfall Method
CW3351 Data and Information Security Unit 1 : Introduction

16. 16
Phase 1:Investigation
ManagementIdentifiesprocess,outcomes,goals,
budgetandconstraintsoftheproject
Beginswithenterpriseinformationsecuritypolicy
Outlineprojectscopeandgoals
Estimatecost
Organizationalfeasibilityanalysisisperformed
CW3351 Data and Information Security Unit 1 : Introduction

17. 17
Phase 2:Analysis
Documentsfrominvestigationphasearestudied
Analyzesexistingsecuritypoliciesorprograms,along
withdocumentedcurrentthreatsandassociated
controls
Studyintegrationnewsystemwithexistingsystem
Includesanalysisofrelevantlegalissuesthatcould
impactdesignofthesecuritysolution
Theriskmanagementtaskbegins
CW3351 Data and Information Security Unit 1 : Introduction

18. 18
Phase 3:Logical Design
Createsanddevelopsblueprintsforinformation
security
Incidentresponseactionsplanned:
Continuityplanning
Incidentresponse
Disasterrecovery
Feasibilityanalysistodeterminewhetherproject
shouldcontinueorbeoutsourced
CW3351 Data and Information Security Unit 1 : Introduction

19. 19
Phase 4:Physical Design
Neededsecuritytechnologyisevaluated,alternatives
generated,andfinaldesignselected
Developdefinitionofsuccessfulsolution
Atendofphase,feasibilitystudydeterminesreadiness
oftheprojectImplementation
CW3351 Data and Information Security Unit 1 : Introduction

20. 20
Phase 5:Implementation
Securitysolutionsareacquired,tested,implemented,
andtestedagain
Personnelissuesevaluated;specifictrainingand
educationprogramsconducted
Entiretestedpackageispresentedtomanagementfor
finalapproval
CW3351 Data and Information Security Unit 1 : Introduction

21. 21
Phase 6:Maintenance and Change
Perhaps the most important phase, given the ever-
changing threat environment
Often, reparation and restoration of information is a
constant duel with an unseen adversary
Information security profile of an organization
requires constant adaptation as new threats emerge
and old threats evolve
CW3351 Data and Information Security Unit 1 : Introduction

22. 22
Key Terms [Terminology]
Access-asubjectorobject’sabilitytouse,manipulate,modify,oraffect
anothersubjectorobject
Asset-theorganizationalresourcethatisbeingprotected.
Attack-anactthatisanintentionalorunintentionalattempttocause
damageorcompromisetotheinformationand/orthesystemsthatsupport
it.
Control,SafeguardorCountermeasure-securitymechanisms,policiesor
proceduresthatcansuccessfullycounterattacks,reducerisk,resolve
vulnerabilities,andotherwiseimprovethesecuritywithinanorganization
Exploit–totakeadvantageofweaknessesorvulnerabilityinasystem
Exposure-asingleinstanceofbeingopentodamage.
Hacking-Good:tousecomputersorsystemsforenjoyment;Bad:toillegally
gainaccesstoacomputerorsystem
Object-apassiveentityintheinformationsystemthatreceivesorcontains
information
Risk-theprobabilitythatsomethingcanhappen.
CW3351 Data and Information Security Unit 1 : Introduction

23. 23
SecurityBlueprint-theplanfortheimplementationofnewsecurity
measuresintheorganization
SecurityModel-acollectionofspecificsecurityrulesthatrepresents
theimplementationofasecuritypolicy
SecurityPostureorSecurityProfile-agenerallabelforthe
combinationofallpolicy,procedures,technology,andprogramsthat
makeupthetotalsecurityeffortcurrentlyinplace
Subject-anactiveentitythatinteractswithaninformationsystemand
causesinformationtomovethroughthesystemforaspecificpurpose
Threats-acategoryofobjects,persons,orotherentitiesthatrepresents
apotentialdangertoanasset.
ThreatAgent-aspecificinstanceorcomponentofamoregeneralthreat
Vulnerability-weaknessesorfaultsinasystemorprotection
mechanismthatexposeinformationtoattackordamage
Key Terms [Terminology]

24. 24
Summary
Informationsecurityisa“well-informedsenseofassurance
thattheinformationrisksandcontrolsareinbalance.”
Computersecuritybeganimmediatelyafterfirstmainframes
weredeveloped
Successfulorganizationshavemultiplelayersofsecurityin
place:physical,personal,operations,communications,
network,andinformation.
Securityshouldbeconsideredabalancebetweenprotection
andavailability
Informationsecuritymustbemanagedsimilartoanymajor
systemimplementedinanorganizationusingamethodology
likeSecSDLC
CW3351 Data and Information Security Unit 1 : Introduction

25. Thank you
25
CW3351 Data and Information Security Unit 1 : Introduction