Overview of Information Security Management: Chapters 1-5

Information Security (InfoSec)

Focuses on protecting information and its characteristics including confidentiality, integrity, and availability.

C.I.A. Triad

The three core principles of InfoSec: confidentiality, integrity, and availability.

Confidentiality

Limiting information access to authorized individuals and preventing unauthorized access.

Integrity

Ensuring the accuracy and completeness of information.

Availability

Ensuring that authorized users have reliable and timely access to information and resources.

CNSS Security Model

Covers confidentiality, integrity, and availability in relation to storage, processing, and transmission.

InfoSec Processes

Include identification, authentication, authorization, and accountability.

Threats to Information Security

Include natural disasters, technical failures, software errors, and human actions.

Mean Time Between Failures (MTBF)

The average time between hardware failures.

Strategic Planning

Occurs at the highest organizational levels covering long-term goals.

Tactical Planning

Focuses on resources and plans over an intermediate period.

Operational Planning

Addresses day-to-day operations and local resources in the short term.

Ethics

The study of moral judgments and how humans ought to act.

Digital Forensics

Involves the preservation and analysis of computer media for evidentiary and root-cause analysis.

Affidavit

Sworn testimony that certain facts warrant the examination of specific items.

U.S. Secret Service

Responsible for detecting and arresting computer fraud offenders.

PCI DSS

Payment Card Industry Data Security Standard that includes security requirements and assessment procedures.

Stakeholders

Individuals or groups with a vested interest in an organization's operations.

Governance in InfoSec

Creating and maintaining organizational structures to manage the InfoSec function.

InfoSec Program

The entire set of activities, resources, personnel, and technologies used to manage risks to information assets.

Project Champion

A senior executive who promotes the project and ensures its support.

Information Security Policy

Critical to the success of the InfoSec program.

EISP (Enterprise Information Security Policy)

Provides a high-level overview of the organization’s security philosophy.

ISSP (Issue-Specific Security Policy)

Addresses specific security issues.

SysSP (System-Specific Security Policy)

Addresses specific systems.

Security Convergence

The merging of management accountability across various security disciplines to enhance efficiency and effectiveness.

Work Breakdown Structure (WBS)

A list of tasks to be accomplished in a project, detailing work, skill sets, start and end dates, estimated resources, and dependencies.