INFORMATION SECURITY MANAGEMENT

INTRODUCTION TO THE MGT OF INFORMATION SECURITY

Course Outline – Topics Covered

Planning for Security and Contingencies Information Security PolicyDeveloping Security ProgramsSecurity Management ModelsRisk Management

Identifying Assessing Controlling

Course Outline – Topics Covered

Protection MechanismPersonnel and SecurityLaw and EthicsSecurity and the Cloud

Classroom Procedures

Most classes will contain the following components: Current Events Lectures Case Studies Project Presentations Various Speakers

Encourage student sharing their experiences

Course Structure:

Assessments (4) 40%

Case Study/Current Events 15%

Topic paper 20%

Demo/Hands-on Lab Project 20%

Class Participation/Discussions 5%

Topic Paper

The primary purpose of this assignment is to provide you an opportunity to further develop practical research skills by investigating an information security and information assurance (IA) related topic (hopefully of personal interest).

Consists of:Executive summary of the topic (~ 1000 – 1500 words)

include an annotated bibliography (with at least 8 references)15-20 minutes presentation of your executive summary to class.

Hands On/Lab Presentation

Prepare a presentation (5-7 minutes) and a live demonstration or hands-on lab exercise (20-25 minutes) on a security related technology.

Consists of:Student HandoutClass PresentationLive DemonstrationAnnotated Bibliography of useful resources

Class Introductions/Expectations

Name

Background

Course Expectations

Information Security Management

Do not figure on opponents not attacking;

worry about your own lack of preparation.

BOOK OF THE FIVE RINGS

Information Security Management

You can have all the protection mechanisms in place and still have security problems:

Information Security Management

The goal of this course is to take a step back and examine how security functions as a whole within the organization.

Challenge:Everything cannot be categorized as right or wrong

What works for one company may fail in another

Certified Information Systems Security Professional (CISSP)

Five years of experience in information security There are 250 multiple-choice questions Exam duration: six hours

SSCP - Systems Security Certified Practitioner

Only one year of experience required Test is 90 minutes long, 50-70 questions

Associate of (ISC)^2 Certification

No experience required Shows that you passed the exam, and that you

are serious about a career in Information Security

Subscribe to the (ISC)² Code of Ethics

Figure 1-1 The Enigma Source: Courtesy of National Security Agency

Early forms of Information Security

The 1990s

Networks of computers became more common; so too did the need to interconnect networks

Internet became first manifestation of a global network of networks

In early Internet deployments, security was treated as a low priority

2000 to Present

The Internet brings millions of computer networks into communication with each other—many of them unsecured

Ability to secure a computer’s data influenced by the security of every computer to which it is connected

Growing threat of cyber attacks has increased the need for improved security

Introduction

The concept of computer security has become synonymous with the concept of information security

Information security is no longer the sole responsibility of a discrete group of people in the company

Information Security Decision Makers

1. Information security mgr and professionals (InfoSec Community)

2. Information technology mgr and professionals(Information Technology Community)

3. Non-technical business mgr and professionals (General Business Community)

What Is Security?

• How do you define security?

• Specialized areas of security• Physical• Operations• Communications• Network

Each of these areas contribute to the information security program as a whole

What Is Information Security?

What is Information security?

How do we achieve Information Security? Policy Technology Training and Awareness Programs

Role of information security is to protect an organization’s information assets

Components of an Information System Information system (IS) is entire set of

components necessary to use information as a resource in the organization Software Hardware Data People Procedures Networks

Principals of Information Security, Fourth Edition 22

Key Information Security Concepts

Access Asset Attack Control, Safeguard, or

Countermeasure Exploit Exposure Loss

23

Protection Profile or Security Posture

Risk Subjects and Objects Threat Threat Agent Vulnerability

Figure 1-1 Components of Information security

Source: Course Technology/Cengage Learninghttp://www.cnss.gov/policies.html

CNSS Security Model (cont’d.)

C.I.A. triangle – Confidentiality, integrity, and availability – Has expanded into a more comprehensive list of

critical characteristics of information

NSTISSC (CNSS) Security Model – Provides a more detailed perspective on security– Covers the three dimensions of information security– Primary purpose: identify gaps in the coverage of

an information security program

CNSS Security Model (cont’d.)

NSTISSC Security Model (cont’d.)– Must address all 27 cells when

designing/reviewing a program

Main Purpose: identify gaps in an information security program

How to measure the value of information - CIA Triangle

IdentificationAuthentication AuthorizationPrivacyAccountability

Expanded toinclude

The value of information comes from the characteristics it possesses

Confidentiality

The characteristic of information whereby only those with sufficient privileges may access certain information

Measures used to protect confidentiality:– Information classification– Secure document storage– Application of general security policies– Education of information custodians and end users

Integrity

The quality or state of being whole, complete, and uncorrupted

Threats to information integrity:– Corruption– Damage– Destruction– Other disruption of its authentic state

Availability

The characteristic of information that enables user access to information in a required format, without interference or obstruction

Availability does not imply that the information is accessible to any user (Implies availability to authorized users)

Identification and Authentication

Identification– An information system possesses the characteristic

of identification when it is able to recognize individual users

– Identification and authentication are essential to establishing the level of access or authorization that an individual is granted

Authentication – Occurs when a control proves that a user possesses

the identity that he or she claims

Authorization

Assures that the user has been specifically and explicitly authorized by the proper authority to access, update, or delete the contents of an information asset

Authorization occurs after authentication

Privacy

Information collected, used, and stored by an organization is to be used only for the purposes stated to the data owner at the time it was collected

Privacy as a characteristic of information does not signify freedom from observation

Means that information will be used only in ways known to the person providing it

Accountability

Exists when a control provides assurance that every activity undertaken can be attributed to a named person or automated process

Balancing Information Security and Access

Impossible to obtain perfect security—it is a process, not an absolute

Security should be considered balance between protection and availability

Information Security: Is it an Art or a Science? Implementation of information security often

described as combination of art and science “Security artesan” idea

Security as Art

No hard and fast rules nor many universally accepted complete solutions

No manual for implementing security through entire system

Security as Science

Dealing with technology designed to operate at high levels of performance

Specific conditions cause virtually all actions that occur in computer systems

Nearly every fault, security hole, and systems malfunction are a result of interaction of specific hardware and software

If developers had sufficient time, they could resolve and eliminate faults

Principles of Information Security Management

Include the following characteristics that will be the focus of the current course (six P’s):

1. Planning

2. Policy

3. Programs

4. Protection

5. People

6. Project Management

http://csrc.nist.gov/publications/PubsTC.html

Planning

• Planning as part of InfoSec management– An extension of the basic planning model

discussed earlier in this chapter

• Included in the InfoSec planning model – Activities necessary to support the design,

creation, and implementation of information security strategies

Planning (cont’d.)

• Types of InfoSec plans– Incident response planning– Business continuity planning– Disaster recovery planning– Policy planning– Personnel planning– Technology rollout planning– Risk management planning– Security program planning

includes education, training and awareness

Policy

• The set of organizational guidelines that dictates certain behavior within the organization

• Three general categories of policy: – Enterprise information security policy (EISP)– Issue-specific security policy (ISSP) – System-specific policies (SysSPs)

UNCW Policies

Programs

• InfoSec operations that are specifically managed as separate entities– Example: a security education training and

awareness (SETA) program

• Other types of programs – Physical security program

complete with fire, physical access, gates, guards, etc.

Protection

• Executed through risk management activities

– Includes:– Risk assessment and control– Protection mechanisms– Technologies– Tools

• Each of these mechanisms represents some aspect of the management of specific controls in the overall information security plan

People

Managers must recognize the crucial role that people play in the information security program

This area of InfoSec includes security personnel and the security of personnel, as well as aspects of a SETA program

The most critical link in the information security program

Project Management

Identifying and controlling the resources applied to the project

Measuring progress

Adjusting the process as progress is made

Summary

• What is security?• Principles of information security

management– Planning– Policy– Programs– Protection– People– Project management

Next Class (in 2 weeks)

• Read Chapter 2 – Planning for Security

• Signup for Entropy • Lecture Slides and additional readings will be

posted in the calendar

• Teams and Topic Selections

• I will cover discussion of cases and current events next week but read them before class!