Information Security_Part_I.pptx very important

Its very important

1. Network Security vs Cyber Security vs Information Security Network security  Network Security the process of taking physical and software preventative measures to protect the underlying networking infrastructure from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, thereby creating a secure platform for computers, users and programs to perform their permitted critical functions within a secure environment.” Cybersecurity   Cybersecurity is the practice of protecting systems, networks and programs from digital attacks which are usually aimed at accessing, changing, or destroying sensitive information; extorting money from users; or interrupting normal business processes. In a Simple term, it is the protection of data and systems in networks that are connected to the internet.” Information security It refers to the processes and methodologies which are designed and implemented to protect print, electronic, or any other form of confidential, private and sensitive information or data from unauthorized access, use, misuse, disclosure, destruction, modification, or disruption.” The reference to “print” and information or data is significant, since cybersecurity pertains solely to digital or electronic information or data. 1

2. 2 Cyber Security Network Security Information Security Cybersecurity is the method of protecting systems, networks, and programs from digital attacks. Network Security is the method of protecting the usability and integrity of your network and data. Information security is the measures taken to protect the records from unauthorized entry and use. Cyber Security is a subpart of Information Security. Network Security is a subpart of Cyber Security. Cyber Security & Network Security comes under Information Security. It protects anything in the cyber area.  It protects anything in the network area. Information security is for information irrespective of the space. It deals with protection from cyber attacks.  It deals with protection from DOS (Denial of Service) attacks. It deals with the security of data from any kind of threat. Cyber ​​security attacks against cybercrime and cyber fraud. Network Security attacks against trojans. Information Security attacks against unauthorized access, disclosure modification, and disruption. Cyber ​​security ensures the security of the entire digital data. Network security only ensures the security of transit data. Information security ensures the protection of transit and digital data. It deals with the security of the data resting. It secures data traveling across the network by terminals. It gives integrity, confidentiality, and availability. Common Cyber Security Risks: Social engineering Brute force Baiting  Ransomware Common Network Security Risks: Viruses, worms, and trojans Denial of Service (DOS) attack  Zero-day attacks Common Information Security Risks: Access Destruction  Availability

3. Why Information Security is needed? Information security is crucial because it safeguards data from unauthorized access, misuse, or loss, protecting sensitive information like customer data, financial records, and intellectual property, which is vital for business continuity, maintaining customer trust, and preventing legal and financial repercussions.   detailed explanation of why information security is needed : 1. Protecting Sensitive Information: Financial Data: Banks, financial institutions, and businesses handle vast amounts of financial data, and a breach can lead to fraud and significant financial losses.   Customer Data: Organizations collect and store personal information about their customers, including names, addresses, email addresses, and payment details. Protecting this data is crucial for maintaining customer trust and preventing privacy violations.  Intellectual Property: Businesses invest heavily in developing and protecting their intellectual property, such as patents, trade secrets, and copyrighted materials. Information security helps prevent theft and unauthorized use of this valuable asset.  Personal Information: Individuals also rely on information security to protect their personal data, such as social security numbers, medical records, and other sensitive information.  3

4. 2. Maintaining Business Continuity: Data Breaches: A data breach can disrupt business operations, lead to system downtime, and cause significant financial losses.  Cyberattacks: Cyberattacks, such as ransomware and phishing, can cripple organizations and lead to the loss of critical data and systems.   Ensuring Availability: Information security ensures that critical data and systems are available when needed, preventing disruptions to business operations.  3.Building Trust and Reputation: Customer Trust: Protecting customer data is essential for building and maintaining trust. A data breach can damage a company's reputation and lead to a loss of customers. Reputational Damage: A security incident can have a lasting impact on a company's reputation, making it difficult to attract and retain customers and partners. Compliance: Organizations must comply with various regulations and standards related to data protection and security. Failure to comply can result in legal penalties and reputational damage.  4

5. 4. Preventing Legal and Financial Consequences: Legal Penalties:  Data breaches can lead to lawsuits, fines, and other legal penalties.  Financial Losses:  Data breaches can result in significant financial losses, including the cost of remediation, legal fees, and lost business.  Insurance Costs:  Organizations may face higher insurance premiums or even be denied coverage if they have weak security practices 5

6. What is a Threat? A threat   is a possible security violation that might exploit the vulnerability of a system or asset. The origin of the threat may be accidental, environmental (natural disaster), human negligence, or human failure. Different types of security threats are interruption, interception, fabrication, and modification. Types of Threats Unstructured Threats:  Unstructured threats are typically executed by inexperienced individuals using easily accessible hacking tools like shell scripts and password crackers. If executed solely to test a hacker’s skills, they can cause significant damage to a company. Structured Threat:  A structured threat involves an organized attempt to breach a specific network or organization. These threats come from highly motivated and technically proficient hackers. External Threats:  External threats might come from individuals or organizations working outside the company. They have unauthorized access to the computer systems and network. They typically enter a network via the Internet or dial-up access servers. Internal Threat:  Internal dangers occur due to authorized network access, whether through a server account or physical access. Threats and Attacks on Information Security 6

7. Various Security Attacks 7 Security Attacks Passive Attacks Active Attacks (Attacker’s Goal is just to obtain information) This attack does not modify or harm the system (This attack may change data or harm the system) Release of Message Contents (Snooping): Traffic Analysis Masquerading or Spoofing: Sniffers can be hardware or software installed on the system.  Spoofing  is the process in which an intruder introduces fake traffic and pretends to be someone else (legal source or the legitimate entity).  Spoofing  is done by sending packets with incorrect source address over the network Replay Modification of messages Repudiation Denial of Service

8. Release of message contents (Snooping) 8 A B m C reads the contents of the Message from A to B Internet C Passive Attack

9. Traffic Analysis 9 A B m C observes pattern of messages from A to B Internet C

10. Masquerading (Spoofing) 10 A B m C pretends to be A and sends a message to B Internet C Attacker impersonates Somebody else Active Attack

11. Modification of message 11 A B Internet C C intercepts the message from A and modifies it and sends it to B

12. Denial of service 12 A B Internet C C sends bogus request to B. C disrupts service provided by the server Server

13. Non repudiation 13 A B Internet 1. Orders cash on delivery Online shopping portal 2. Supplies the product 3. A denies that it has given the order Sender or receiver might later deny that he/she has sent a message

14. Threat Attack Threats can be intentional or unintentional. The attack is intentional. Threats may or may not be malicious. The attack is malicious. Circumstances that can cause damage. The objective is to cause damage. Information may or may not be altered or damaged. The chance for information alteration and damage is very high. The threat is comparatively hard to detect. Comparatively easy to detect. Can be blocked by control of vulnerabilities. Cannot be blocked by just controlling the vulnerabilities. Can be initiated by the system itself as well as by outsiders. An attack is always initiated by an outsider (system or user). Can be classified into Physical, internal, external, human, and non-physical threatsats. These can be classified into   Viruses , Spyware,  Phishing , Worms, Spam, Botnets,  DoS attacks ,  Ransomware , and Breaches. 14

15. 15 Breakdown of best practices: General Security Practices: Strong Passwords and Authentication: Use unique, strong, and complex passwords for all accounts.  Enable two-factor authentication (2FA) whenever possible.  Consider using a password manager to store and manage passwords securely.  Software Updates: Keep your operating system, web browser, and other software up-to-date with the latest security patches.  Email and Link Security: Be wary of suspicious emails and links, especially those from unknown senders.  Avoid opening attachments from untrusted sources.  Verify the legitimacy of links before clicking on them.  Data Backup: Regularly back up your important data to an external hard drive or cloud storage service.  Antivirus and Anti-Malware Software: Install and regularly update antivirus and anti-malware software on your devices.  Security Awareness Training: Stay informed about the latest cyber threats and learn how to recognize and avoid them.  Educate yourself and others about safe online practices.  Best Practices to mitigate information security threats and attacks

16. 16 Physical Security: Secure your devices and data, especially when in public places.  Lock your screen when you walk away from your devices.  Consider encrypting your hard drive.  Network Security: Secure your Wi-Fi network.  Use a firewall to protect your network.  Consider using a VPN for added privacy and security.  Incident Response Plan: Develop a plan to respond to security incidents.  Monitor Third-Party Access: Monitor third-party access to your data to ensure only authorized parties have access.  Network Segmentation: Segment your network to isolate sensitive traffic and secure critical IT systems.  Access Control Lists (ACLs): Limit and segment user rights for access by implementing proper Access Control Lists (ACLs) in the network.  Firewall: Use a network firewall to restrict traffic movement outside the network segment

17. Principles of Information Security The core principles of information security, often referred to as the CIA triad, are  confidentiality, integrity, and availability , ensuring that sensitive information is protected from unauthorized access, remains accurate and reliable, and is accessible when needed 17

18. Principles of Information Security 1. Confidentiality: Preserving authorized restrictions on information access and disclosure. 18 A B m No third party should be able to read the message m

19. Principles of Information Security 2. Integrity: Means that changes need to be done only by authorized entities through authorized mechanisms. 19 A B m m should reach B as sent by A

20. Principles of Network Security 3. Availability: The information created and stored needs to be available to the authorized entities. 20 A B m m should be available to B whenever required

21. Information Security Management System Policy Definition: Policies are high-level statements that define an organization's approach to cybersecurity, setting the overall direction and expectations.  Purpose: They establish the "why" behind security measures, providing a foundation for all other security efforts.  Examples: cceptable Use Policy, Information Security Policy, BYOD (Bring Your Own Device) Policy, Incident Response Policy.  Procedures Definition: Procedures are the specific steps or actions that employees or systems must follow to implement a policy. Purpose: They provide the "how " behind the policies, ensuring that security measures are consistently and effectively executed. Examples: Password reset procedure, incident reporting procedure, vulnerability scanning procedure, data backup procedure.  Policies, procedures, standards, administrative measures, and technical measures related to information security of an organization are collectively referred to as an  Information Security Management System (ISMS) 21

22. Guidelines Definition: Guidelines offer recommendations or suggestions on how to implement policies and procedures. Purpose: They provide flexibility and allow for adaptation to specific circumstances while maintaining a consistent security approach. Examples: Guidelines for secure coding practices, guidelines for network segmentation, guidelines for data encryption Standards Definition:   Standards are formal, documented requirements that must be met to achieve a specific security objective.  Purpose:   They establish a baseline level of security and ensure that all relevant systems and processes meet a minimum security threshold.  Examples:   ISO 27001, PCI DSS, HIPAA, NIST Cybersecurity Framework.  Information Security Management System 22

23. Administrative Measures Definition: Administrative measures are the policies, procedures and processes that an organization uses to manage its security framework. Technical Measures Definition: Technical measures are the technologies and tools used to protect information and systems from cyber threats. Purpose: They provide the technical safeguards that protect against unauthorized access, data breaches, and other cyberattacks. Examples: Firewalls , intrusion detection systems, antivirus software, encryption, multi-factor authentication.  Purpose: They focus on the human element of security, including training, awareness, and incident response. Examples: Security awareness training, incident response plan, access control policies, background checks.  Information Security Management System 23

24. In cybersecurity, the "People, Process, and Technology" (PPT) framework emphasizes the interconnectedness of these three elements for effective threat protection, with each playing a crucial role in building a robust security posture.   People, Process and Technology(PPT) Information Security Management System 24

25. Here's a breakdown of each element People: This encompasses all individuals within an organization, including employees, contractors, and stakeholders, who are responsible for security practices and data handling. Processes: These are the policies, procedures, and protocols that guide information security practices, ensuring a structured approach to managing and protecting data. Technology: This refers to the tools and solutions used to protect information assets, such as firewalls, antivirus software, encryption, and intrusion detection systems. Interconnection and Benefits: Interdependence: The three pillars are deeply interconnected, and a strong security strategy requires a balanced approach that considers all three elements.  Enhanced Security: By focusing on people, processes, and technology, organizations can create a more resilient and effective defense against cyber threats.  Improved Risk Management: A well-defined PPT framework allows for better identification, assessment, and mitigation of cybersecurity risks.  Increased Compliance: Adhering to industry standards and regulations often requires a robust PPT framework.  Better Business Outcomes: A strong cybersecurity posture can lead to increased trust, reduced costs, and improved operational efficiency People, Process and Technology(PPT) 25

26. To implement effective information security, prioritize the CIA triad (Confidentiality, Integrity, and Availability) and adopt security best practices like strong authentication, access control, data encryption, and regular security audits, while also educating users about cyber threats.   breakdown of best practices for information security principles : 1.The CIA Triad: Confidentiality: Protect sensitive information from unauthorized access or disclosure.  Best Practices:  Implement strong access controls, encrypt data at rest and in transit, and use secure authentication methods.   Integrity: Ensure data is accurate, complete, and hasn't been altered without authorization.  Best Practices:  Use data validation techniques, implement version control, and regularly back up data.  Availability: Ensure authorized users can access information and resources when needed.  Best Practices:  Implement redundancy, disaster recovery plans, and regularly test backup and recovery processes.  Best practices for Principles of Information Security 26

27. 2. Security Controls Access Control: Limit access to information and resources based on the principle of least privilege, ensuring users only have the necessary permissions.  Authentication: Verify the identity of users and devices attempting to access systems.  Best Practices:  Implement strong passwords, multi-factor authentication, and biometric authentication where appropriate.  Encryption: Protect sensitive data by converting it into an unreadable format.  Best Practices:  Use strong encryption algorithms and keep encryption keys secure.  Firewalls and Intrusion Detection/Prevention Systems: Protect networks from unauthorized access and malicious activity.  Data Backup and Recovery: Regularly back up data and test recovery processes to ensure business continuity.  Secure Coding Practices: Develop software applications with security in mind, minimizing vulnerabilities .  27

28. 3. Security Awareness and Training : Educate Users:  Train employees on information security risks, best practices, and incident reporting procedures. Promote a Security Culture:  Encourage users to be vigilant and report suspicious activity.  4. Incident Response : Develop an Incident Response Plan:  Outline procedures for detecting, responding to, and recovering from security incidents. Regularly Test and Update the Plan:  Ensure the plan is effective and up-to-date.  5. Monitoring and Auditing: Implement Security Monitoring Tools:  Monitor systems and networks for suspicious activity. Conduct Regular Security Audits:  Evaluate security controls and identify vulnerabilities.  28