MODULE 1: Introduction to Information Security

Information Security

The protection of information and its critical elements, including the systems and hardware that use, store, and transmit it

Confidentiality

Preventing unauthorized disclosure of information

Integrity

Preventing unauthorized or accidental modification of information

Availability

Ensuring authorized users have timely, uninterrupted access to information

C.I.A. Triangle

The historic industry standard for computer security, built on Confidentiality, Integrity, and Availability

Accuracy

Information is free from mistakes or errors and has constant integrity

Authenticity

Information is genuine and original, not corrupted, falsified, or simulated

Utility

Information has a useful purpose or value

Possession

The physical ownership or control of the information container/medium

CNSS Security Model (McCumber Cube)

A 27-cell evaluation framework represented by a 3x3x3 cube mapping Security Objectives, Information States, and Security Measures

Rand Report R-609

A seminal DoD-sponsored paper that started the formal study of computer security, expanding it beyond physical protection

MULTICS

An early timesharing operating system that attempted to build security into software

ARPANET

The precursor to the Internet, developed by Larry Roberts through ARPA

Asset

Any organizational resource, physical or logical, that needs protection

Access

An authorized subject's ability to use, manipulate, or integrate with an asset

Attack

An intentional or unintentional act that can damage or compromise information assets

Control, Safeguard, or Countermeasure

Mechanisms designed to prevent, detect, or mitigate attacks and reduce risk

Exploit

A technique or tool used by threat agents to take advantage of a system's vulnerability

Exposure

A state of vulnerability where an asset is open to being compromised

Loss

Any damage, theft, or destruction of an asset

Protection Profile / Security Posture

The complete, integrated set of security controls and policies an organization has in place

Risk

The probability that a vulnerability will be exploited by a threat agent to cause loss

Threat

Any category of object, person, or force that represents a constant danger to an asset

Threat Agent

The specific instance of a threat, such as a specific hacker or a specific hurricane

Vulnerability

A weakness, flaw, or loophole in a system or security posture

Computer as the Subject

The computer is used as an active tool to conduct an attack, such as sending spam or launching DDoS

Computer as the Object

The computer is the target being attacked, such as having its database stolen or system shut down

Software (IS component)

Applications and operating systems

Hardware (IS component)

Physical computing machinery

Data (IS component)

Stored files, databases, and transactions; the primary target of attacks

People (IS component)

Users, administrators, and stakeholders; often the weakest link

Procedures (IS component)

Written instructions, policies, and regulations

Networks (IS component)

Communication lines and protocols

Bottom-Up Approach

Systems administrators drive security improvements from the grassroots technical level; often fails from lack of executive support

Top-Down Approach

Security initiated and structured by upper management with strong support, funding, and a formal SDLC

SDLC

Systems Development Life Cycle; a structured, multi-phase process for developing information systems

SecSDLC

Security Systems Development Life Cycle; a structured, multi-phase process for developing a security program

The Champion

A high-level executive sponsor who secures administrative backing, corporate visibility, and critical project funding

The Team Leader

A project manager who coordinates tasks, manages personnel, and understands the technical/policy demands of InfoSec

Security Policy Developers

Professionals skilled in mapping organizational culture and compliance mandates to practical security policies

Risk Assessment Specialists

Experts in quantifying asset value, performing financial risk assessments, and evaluating control costs

Security Professionals

Technical specialists who design, configure, and implement systems and network security controls

Systems Administrators

IT staff responsible for day-to-day hosting, upkeep, and performance of system environments

End Users

The actual operators of systems who provide feedback to ensure security controls do not disrupt workflows

Data Owner

Senior executives ultimately responsible for the overall security and classification of a specific dataset

Data Custodian

Technical staff, usually SysAdmins, responsible for the storage, backup, transport, and active protection of data

Data Users

Employees who interact with data during daily duties and must adhere to handling policies

Security as Art

Implementation requires subjective judgment, creative problem-solving, and tailored designs unique to each organization

Security as Science

Built on high-performance technology and logical, predictable, quantifiable outcomes of software and hardware flaws

Security as a Social Science

Focuses on human behaviors, since humans are the weakest link, requiring attention to sociology and psychology

Virus

Code that infects systems and replicates by attaching to other files

Worm

An independent program that replicates itself across networks

Trojan Horse

Desirable software hiding a malicious payload

Logic Bomb

Code triggered by a specific event or time

Back Door (Trap Door)

A mechanism that bypasses normal authentication to grant access

Polymorphic Threat

Malware that changes its shape/signature to evade detection

Expert Hacker

A hacker who develops software scripts, writes exploits, and masters multiple technical skills

Script Kiddie

An unskilled hacker who uses expertly written tools without fully understanding the underlying systems

Information Extortion

Stealing information and demanding payment for its return or nondisclosure, common in credit card theft

Technological Obsolescence

Outdated or antiquated infrastructure leading to untrustworthy, unreliable systems

Password Crack

Attempting to reverse-calculate or guess an encrypted password

Brute Force

Utilizing raw computing power to try every possible combination of a password

Dictionary Attack

Targeted password guessing that uses a pre-compiled list of common passwords

Denial-of-Service (DoS)

Sending a massive volume of connection or information requests to crash a target system or block legitimate traffic

Distributed DoS (DDoS)

A coordinated stream of DoS requests launched from many locations simultaneously

Spoofing

Forging packet headers, like IP addresses, to make a transmission appear to originate from a trusted host

Man-in-the-Middle

Sniffing network packets, modifying them, and re-inserting them into the path; also called TCP Hijacking

Spam

Unsolicited commercial e-mail that serves as an active attack vector for malware

Mail Bombing

A specific form of DoS where massive quantities of e-mail are directed to a target inbox

Simplicity (SA principle)

Keep the software design as simple and small as possible

Permission, Not Exclusion

Access decisions must be based on explicit permission rather than blocking, i.e. Default Deny

Continuous Verification

Every single access to every object must be checked for authority

Key-Based Security

Protection must depend on the strength of keys/passwords, not the secrecy of the design

Dual Control

Critical mechanisms should require two independent keys to unlock, preventing single points of failure

Least Privilege

Programs and users must utilize only the privileges necessary to complete their tasks

Buffer Overrun

Writing more data to an allocation zone than it is built to hold, corrupting memory

Command Injection

Passing malicious user input directly to system command interpreters

Cross-Site Scripting (XSS)

Injecting malicious scripts into trusted websites viewed by other users