Information security FundameFundamentals.pptx

Information Security fundamentals

1. Chapter IA: A Comprehensive Overview Infosec or computer security is a multifaceted field that encompasses the protection of information systems and their resources. It aims to ensure the confidentiality, integrity, and availability of data, software, hardware, and communication networks. This course delves into the fundamental concepts, threats, attacks, and strategies employed to safeguard computer systems in today's interconnected world.

2. This definition encompasses three key objectives that are at the heart of InfoSec: 1 Confidentiality Confidentiality ensures that sensitive information is protected from unauthorized access and disclosure. This includes safeguarding personal data, proprietary information, and trade secrets. 2 Integrity Integrity guarantees that data and systems remain accurate and unaltered. It prevents unauthorized modifications, ensuring that information is reliable and trustworthy. 3 Availability Availability ensures that systems and resources are accessible to authorized users when needed. It safeguards against disruptions, outages, and denial-of-service attacks.

3. Although the use of the CIA triad to define security objectives is well established, some experts in the security field feel that additional concepts are needed to provide a complete picture, two of the most commonly mentioned are as follows: 4 Authenticity The property of being genuine and being able to be verified and Trusted, confidence in the validity of messages and processes. 5 Accountability The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity.

4. Categories and levels of impact of loss of security breach or a loss of the three security objectives: 1 Low 2 Moderate A breach at this level has a serious adverse effect on organizational operations, assets, or individuals. 3 High A breach at this level has a severe or catastrophic adverse effect on organizational operations, assets, or individuals. A breach at this level has a limited adverse effect on organizational operations, assets, or individuals.

5. Categories and levels of impact of loss of security breach or a loss of the three security objectives: 1 Low The loss could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. A limited adverse effect means that, for example, the loss of confidentiality, integrity, or availability might ( i ) cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced Examples include, A list of employee email addresses is accidentally shared with unauthorized external individuals.

6. Categories and levels of impact of loss of security breach or a loss of the three security objectives: 2 Moderate The loss could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. A serious adverse effect example could be Internal financial reports are accessed by unauthorized personnel and leaked externally, or the payroll data of the employees is tampered with, this has administrative burden in the form of labour and time needed to correct these errors causing a significant impact on the operations.

7. Categories and levels of impact of loss of security breach or a loss of the three security objectives: 3 High The loss could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. A severe or catastrophic adverse effect means that, for example, the loss might ( i ) cause a severe degradation in or loss of mission capability to an extent and duration that the organization is not able to perform one or more of its primary functions; Examples include A breach exposes customers' credit card details and personal identification information, which could result in major financial losses, loss of trust in the company thus affecting it’s stock prices and legal consequences and reparations. Another example could be the tampering with the data of patients in a hospital database which could lead to the administering of wrong medications causing potential loss of lives and the degradation of the healthcare provider reputation halting it’s core operations.

8. Information Security Terminology 1 Adversary (Threat Agent) An adversary, often referred to as a threat agent, is an entity that poses a threat to the security of a system. This can include individuals, groups, or organizations that have the intention and capability to attack a system. 2 Attack An attack on system security is an intentional and intelligent act that aims to compromise the integrity, confidentiality, or availability of a system. This involves the use of specific methods or techniques to evade security measures and violate the security policies governing the system. 3 Countermeasure A countermeasure is an action, device, procedure, or technique implemented to mitigate the impact of a threat, vulnerability, or attack on a system. Countermeasures aim to either eliminate or prevent the threat, reduce the potential harm it can cause, or detect and report it so that appropriate corrective actions can be taken. Examples of countermeasures include firewalls, encryption, intrusion detection systems, and security policies and procedures.

9. Information Security Terminology 4 Risk In the context of information security, risk is the expectation of loss expressed as the probability that a specific threat will exploit a particular vulnerability, resulting in a harmful outcome. Risk assessment involves identifying potential threats, evaluating the vulnerabilities within the system, and estimating the likelihood and impact of these threats materializing 5 Security Policy A security policy is a comprehensive set of rules and practices that define how an organization manages and protects its information assets. These policies specify the security measures and procedures that must be followed to safeguard sensitive and critical system resources. A well-defined security policy addresses various aspects of security, including access control, data protection, incident response, and user responsibilities 6 System Resource (Asset) A system resource, or asset, encompasses all components and data within an information system that are valuable to the organization. This includes data stored in the system, services provided by the system, and system capabilities such as processing power and communication bandwidth. Additionally, system resources include hardware, firmware, software, documentation, and facilities that support system operations.

10. Information Security Terminology 7 Threat A threat represents the potential for a security violation due to certain circumstances, capabilities, actions, or events that could harm the system. Threats can be intentional, such as those posed by hackers or malicious insiders, or unintentional, such as those resulting from natural disasters or human error. 8 Vulnerability A vulnerability is a weakness or flaw in a system's design, implementation, operation, or management that can be exploited to violate the system's security policy. Vulnerabilities can arise from various sources, including software bugs, misconfigurations, inadequate access controls, and insufficient security awareness among users

11. Security Concepts and Relations Diagram

12. Types of System Assets Hardware Hardware constitutes the physical components of a computer system. This encompasses everything from the central processing unit (CPU) and memory to storage devices, peripherals, and networking equipment. It's crucial to protect hardware from physical damage, theft, and unauthorized access. Software Software encompasses the programs and instructions that control the hardware. This includes the operating system, system utilities, and applications. Software vulnerabilities can lead to malware infections, data breaches, and system instability. Security measures focus on software updates, anti-virus protection, and access controls.

13. Types of System Assets Data Data is the lifeblood of any computer system. It encompasses files, databases, and security-related information like passwords. Protecting data from unauthorized access, modification, or deletion is critical. Encryption, access controls, and data backups are essential security measures.

14. Security Functional Requirements

15. Identification and Authentication User Identification Accurate user identification is the first step in securing access to organizational information systems. This involves establishing a process for identifying and registering authorized users. Various methods can be employed, such as unique usernames, employee IDs, or biometrics. Authentication Verification Authentication verifies the identity of users, processes, or devices attempting to access organizational systems. Strong authentication methods, such as multi-factor authentication, are essential for preventing unauthorized access. These methods typically involve combining multiple factors, such as something the user knows (password), something the user has (token), or something the user is (biometrics). Access Control Once a user's identity is verified, access control mechanisms are used to restrict access to specific resources based on user roles and permissions. This ensures that users only have access to the information and systems they need for their authorized tasks.

16. Configuration Management Baseline Configurations Establishing baseline configurations for all organizational information systems is the foundation of effective configuration management. This includes documenting hardware, software, firmware, and relevant documentation for each system. Maintaining these baselines throughout the system development life cycle ensures that systems are consistently configured and that changes are tracked and managed. Security Configuration Settings Enforcing stringent security configuration settings for information technology products is critical for preventing unauthorized access and mitigating vulnerabilities. This involves configuring operating systems, applications, and network devices to restrict access, limit privileges, and implement security features such as firewalls and intrusion detection systems. Inventory Management Maintaining a comprehensive inventory of all organizational information systems is essential for effective configuration management. This inventory should include detailed information about each system, such as its location, hardware specifications, software versions, and security configurations. Regular updates to the inventory ensure accurate records and support efficient management.

17. Contingency Planning 1 Emergency Response Planning Developing a detailed emergency response plan is crucial for handling unforeseen incidents that could disrupt critical operations. This plan should outline procedures for responding to various scenarios, such as natural disasters, cyberattacks, or system failures. The plan should include roles and responsibilities for key personnel, communication protocols, and escalation procedures. 2 Backup Operations Implementing robust backup operations is essential for safeguarding critical organizational data. Regular backups of data, applications, and configurations should be conducted and stored securely in offsite locations. The backup strategy should include regular testing to ensure data integrity and timely recovery in the event of a disaster. 3 Post-Disaster Recovery Planning for post-disaster recovery is critical for restoring operations and minimizing downtime. This involves establishing procedures for recovering data, restoring systems, and resuming business operations after a disruptive event. Regular disaster recovery drills are vital for testing the plan and ensuring preparedness.

18. Incident Response Incident Preparation Proactive incident preparation is crucial for minimizing the impact of security breaches. This involves developing comprehensive incident response plans, defining roles and responsibilities, establishing communication protocols, and creating training programs for personnel. Incident Detection Effective incident detection involves implementing monitoring tools, security information and event management (SIEM) systems, and intrusion detection systems to identify suspicious activities and potential security threats. Prompt detection is crucial for minimizing the damage caused by security incidents. Incident Recovery Incident recovery focuses on restoring affected systems and data to their pre-incident state. This involves restoring backups, patching vulnerabilities, and implementing security measures to prevent future attacks. A comprehensive recovery plan ensures that operations are restored efficiently and minimizes downtime. Post-Incident Review After a security incident, it is important to conduct a thorough post-incident review to learn from the experience and improve future responses. This involves analyzing the incident, identifying weaknesses, and implementing necessary improvements to security policies, procedures, and systems.

19. Incident Response Incident Analysis Once an incident is detected, it is crucial to analyze the nature, scope, and potential impact of the event. This involves gathering evidence, identifying the affected systems, and determining the root cause of the incident. A thorough analysis is essential for effective remediation and incident response. Incident Containment Containing the spread of a security incident is paramount for preventing further damage. This involves isolating affected systems, limiting access to sensitive information, and taking steps to prevent the incident from escalating. Prompt containment can help mitigate the impact of the incident and reduce the overall damage. Incident Recovery Incident recovery focuses on restoring affected systems and data to their pre-incident state. This involves restoring backups, patching vulnerabilities, and implementing security measures to prevent future attacks. A comprehensive recovery plan ensures that operations are restored efficiently and minimizes downtime. Post-Incident Review After a security incident, it is important to conduct a thorough post-incident review to learn from the experience and improve future responses. This involves analyzing the incident, identifying weaknesses, and implementing necessary improvements to security policies, procedures, and systems.

20. Maintenance 1 Periodic Maintenance Regular and timely maintenance of information systems is crucial for ensuring their stability, performance, and security. This involves performing regular checks and updates to hardware, software, and firmware to address vulnerabilities, improve performance, and maintain operational efficiency. 2 Security Patch Management Promptly applying security patches to address known vulnerabilities is critical for preventing attackers from exploiting weaknesses in systems. Implementing a robust patch management process ensures that patches are tested, deployed, and monitored effectively. 3 Configuration Audits Regular configuration audits help ensure that systems are configured according to security policies and best practices. These audits identify any deviations from established standards and provide an opportunity to remediate vulnerabilities and maintain a secure configuration. 4 System Upgrades Regularly upgrading systems to the latest versions of software and hardware can enhance security, improve performance, and ensure compatibility with emerging technologies. Implementing a phased upgrade approach minimizes disruptions to operations while maximizing security benefits.

21. Media Protection Physical Media Protection Protect physical storage media, such as hard drives, tapes, and optical discs, from unauthorized access and damage. Implement physical safeguards, such as secure storage facilities, access controls, and environmental controls, to ensure the integrity and confidentiality of media . Digital Media Protection Protect digital media, such as electronic files, databases, and virtual machines, from unauthorized access, modification, and deletion. Implement access controls, encryption, and data integrity checks to ensure the security of digital media. Media Sanitization and Destruction Properly sanitize or destroy media before disposal or reuse to prevent data breaches. Securely erase or overwrite digital media, and physically destroy physical media to render it unusable and prevent data recovery.

22. Audit and Accountability Auditing and accountability are essential for ensuring that information systems are used appropriately and that security controls are effective. This involves tracking user activity, identifying potential security breaches, and holding individuals accountable for their actions. System Auditing Regular audits of information systems should be conducted to assess the effectiveness of security controls and identify any vulnerabilities or weaknesses. Log Analysis System logs should be regularly analyzed to detect suspicious activity, identify potential security breaches, and track user actions. Accountability Organizations should have mechanisms in place to hold individuals accountable for their actions related to information security, including disciplinary measures for violations of security policies.

23. Physical and Environmental Protection Physical Access Control Implement physical access controls to limit access to information systems, equipment, and operating environments to authorized personnel. This includes secure entry points, access control systems, surveillance cameras, and security personnel to prevent unauthorized entry. Physical Plant Protection Protect the physical infrastructure, including buildings, power systems, and communication networks, from unauthorized access, damage, and disruption. Implement security measures, such as perimeter fences, intrusion detection systems, and environmental monitoring systems, to safeguard the physical plant.

24. Awareness and Training Organizations must ensure that their employees are aware of the security risks associated with their activities and are adequately trained to comply with security policies and procedures. This includes educating them about common threats, vulnerabilities, and best practices for protecting sensitive information. 1 Security Policies Organizations should develop and implement comprehensive security policies that outline acceptable and unacceptable behaviors related to information security. 2 Security Awareness Training Regular security awareness training should be provided to all employees, covering topics such as phishing, social engineering, and password security. 3 Incident Reporting Employees should be trained to recognize and report suspicious activities or potential security incidents to the appropriate authorities.

25. Certification, Accreditation, and Security Assessments Organizations should periodically assess the security controls in their information systems to ensure that they are effective in protecting sensitive data. This involves conducting security assessments, identifying vulnerabilities, and implementing corrective actions. Security Assessment A comprehensive security assessment should be conducted to identify vulnerabilities, weaknesses, and potential risks within the information system. Vulnerability Remediation Corrective actions should be taken to address identified vulnerabilities, including patching software, implementing security controls, and updating security policies. Certification and Accreditation Once vulnerabilities have been addressed, the information system should be certified and accredited, indicating that it meets established security standards and is authorized for operation.