Introduction to IT Security Management

Vocabulary-style flashcards covering key terms and definitions from the lecture notes.

IT Security Management (ITSM)

Monitoring and administering an organization's IT systems to secure information and data, aiming to ensure confidentiality, integrity, and availability.

CIA

Confidentiality, Integrity, and Availability—the core security properties protecting information and IT services.

IT Management

Management of hardware, networks, and software to meet business requirements, budgets, security, and service delivery.

On-premises, Cloud, and Hybrid IT

Deployment models: on-premises (in-house), cloud (external), or hybrid (a mix).

CIO

Chief Information Officer; senior leader setting IT strategy and overseeing implementation.

CISO

Chief Information Security Officer; senior leader focusing on information, cyber, and technology security.

Security Administrator

Person responsible for day-to-day management of security technology and systems.

Cloud Security Manager

Role focusing on security management of cloud-based infrastructure.

Threat Intelligence Manager

Role focusing on proactive identification and mitigation of cyber threats.

Cybersecurity

The study, protection, and prevention of computer systems from adversaries; involving a wide range of devices and networks.

Data Breaches (2019 data)

In the first nine months of 2019, 7.9 billion records were exposed by data breaches.

Scale of Cyber Threats—Financial Sector

Disruptive and destructive attacks have increased; responsibility for protection is unclear, but resources exist to implement solutions.

Cybersecurity Culture

The knowledge, beliefs, attitudes, norms, and values about cybersecurity and how they influence behavior with information technologies.
How they think and act in cybersecurity.

Organizational determinants of culture

Leadership, clear policies, regular training, updated technology, accountability, and open communication that support secure practices.

Individual determinants of culture

Awareness, responsibility, ethics, knowledge, positive attitudes, and good habits of individuals that contribute to cybersecurity.

Need for CSC

Most data breaches result from human factors; cybersecurity culture aims to embed a secure mindset in the organization.

Organizational Cybersecurity Culture (OCC)

A model examining how organizational culture, national culture, and information security culture interact in cybersecurity.

Organizational Culture Types

Four orientations:
support (focus on people/relationships),
innovation (Encourage creativity/risk-taking),
rules (Emphasizes stability/procedures),
and goal (results-driven).

Hofstede's National Culture Dimensions

Cross-cultural framework on how national culture affects compliance with rules and policies (dimensions include individualism-collectivism, long-term vs short-term, indulgence vs restraint).

Individualism VS Collectivism

Individualism- Prioritizing personal goals, independence, and self-interest.

Collectivism -Valuing group harmony, loyalty, and shared responsibility.

Long-term VS Short-term Orientation

Long-term- Focus on future rewards, perseverance, and tradition.

Short-term- Want quick results and respect for tradition.

Indulgence VS Restraint

Indulgence- Societies allowing free gratification of desires and leisure.

Restraint societies regulate needs through strict norms and self-control.

Information Culture

Attitudes, beliefs, values, and knowledge are used to interact with information systems; behavior results in incidents and evolves.

Building a CSC

Culture extends beyond awareness to include the shaping of beliefs, norms, and values.

A similar goal can be said for cybersecurity: every employee must act in policy ways that keep the organization’s cybersecurity.

IT environment

Consists of a multitude of hardware, network, and software components.

IT infrastructure

Can be on premises, in the cloud, or on a hybrid platform that integrates both.

IT Security Management Roles and Positions

The Chief Information Officer (CIO)

Security Administrator

Emerging Positions

-Cloud Security Manager

-Threat Intelligence Manager

CIO vs CISO

CIOs’ jobs are generalists

CISOs' jobs are more focused on security