slide session 12 - information security

information security

the protection of information systems and data from unauthorized (accidental or intentional) modification, destruction, or disclosure

the importance of information security

• security breaches are pervasive

• security breaches are costly

• cybercrime has increased by 600% since the beginning of the COVID pandemic

sources of vulnerability in information security

• you and me

• operating system flaws

• network complexity

• inadequate security policies

• lack of training in information security procedures

information security threats

• malicious code

• denials of service

• social engineering

• information theft

• SQL injections

malicious code

also known as malware

• virus

• worm

• trojan horse

• ransomware

denials of service

• DoS (sabotage, not theft)

• DDoS

social engineering

gaining access to a network through manipulation of a legitimate user or administrator

• confidence scheme for the digital era

• phishing is a common form of this

information theft

• packets can be intercepted by packet sniffers

• man-in-the-middle attacks

• builds upon other attack methods

SQL injections

the introduction of malicious SQL statements into a
database system, enabling illegitimate access to
organizational records

• generally used to attack websites

• can be used for data theft, destruction, tampering, etc

ways to confront threats to information security

• people

• policy

• technology

people

• the biggest issue surrounding info security is ___

• 60% of security incidents originate inside the firm

• be skeptical

• don’t opens emails from people you don’t know

• download + install security patches and software updates

information security policies

orgs should develop ___ and an information security plan to combat threats

• identifies the rules required to maintain information security

• info security plan details how an org will implement the info security policies

technology

addresses these security concerns:

• authentication + authorization

• prevention and resistance

• detection and response

authentication

a method for confirming the user’s identities

• involves some combination of:

• something the user knows

• something the user has

• something that’s part of the user

authorization

the process of giving someone permission to do/have something

prevention and resistance

technologies that help prevent/build resistance to attacks including:

• content filtering

• encryption

• firewalls

content filtering

preventing the transmission of sensitive information

encryption

scrambling information into an alternative form that requires a key or password to decrypt the information

firewalls

a hardware and software solution designed to create a barrier around a private network

detection and response

• used to mitigate damage caused by a security breach

• antivirus software is the most common type of ____ technology