ch01

Introduction to Information Security

• Quote: "Do not figure on opponents not attacking; worry about your own lack of preparation" - Book of the Five Rings

• Understanding information security is critical in the face of continual threats.

Learning Objectives

• Define information security.

• Relate the history of computer security and its evolution into information security.

• Define key terms and critical concepts of information security.

• Discuss the phases of the security systems development life cycle (SDLC).

• Present the roles of professionals involved in information security within an organization.

Definition of Information Security

• Information security is described as a "well-informed sense of assurance that the information risks and controls are in balance" (Jim Anderson, Inovant, 2002).

• Understanding the origins of this field helps frame current information security strategies.

The History of Information Security

• Originated shortly after the first mainframes were developed.

• Involves the development of code-breaking computations during WWII, leading to modern computing.

• Focus on physical controls to restrict access to sensitive military areas, laid groundwork for computer security measures.

The Enigma Machine

• Early versions of the German code machine, Enigma, were broken during the 1930s and further developed during WWII.

• The intelligence gained was crucial for Allied military strategy and operations.

The 1960s Development

• ARPA began research into redundant network communications.

• Larry Roberts played a key role in developing ARPANET, the precursor to modern Internet.

Goals of ARPA

• Focus on resource sharing amongst interconnected computers.

• Program Plan No. 723 created in 1968 outlined objectives for networking capabilities.

The 1970s and 80s Security Developments

• The growing popularity of ARPANET led to the emergence of fundamental security problems.

• Lack of safety procedures for dial-up connections, user identification, and authorization systems.

• The Rand Report R-609 marked a pivotal expansion from physical security to include data safety and user accessibility.

Early Research - MULTICS

• The MULTICS project (Multiplexed Information and Computing Service) aimed to create a secure operating system with user permissions and controls.

• Influenced the development of UNIX, a system focused on text processing.

The 1990s and Current Landscape

• Networks became ubiquitous, leading to a need for improved interconnectivity and security measures.

• The Internet emerged as a critical network, initially overlooking security concerns.

• Today, poorly secured networks are commonplace, necessitating comprehensive security strategies.

Components of Information Security

• Definition of Security: "The quality or state of being secure—to be free from danger."

• A successful organization must implement a multi-layered security approach, including:

  • Physical security

  • Personal security

  • Operations security

  • Communications security

  • Network security

  • Information security

C.I.A. Triangle

• Core principles of information security include:

  • Confidentiality: Protecting information from unauthorized access.

  • Integrity: Ensuring accuracy and consistency of data over its lifecycle.

  • Availability: Ensuring that authorized users have access to information when needed.

Critical Characteristics of Information

• Key characteristics include:

  • Availability

  • Accuracy

  • Authenticity

  • Confidentiality

  • Integrity

  • Utility

  • Possession

Security Models and Components

• The NSTISSC Model emphasizes confidentiality, integrity, and availability in information handling.

• An information system consists of software, hardware, data, people, procedures, and networks essential for using information within an organization.

Attack Types

• Subject of Attack: A computer used actively in an attack.

• Object of Attack: A computer being attacked.

Balancing Information Security and Access

• Emphasizes that perfect security is unattainable; seeks a balance between protection and availability.

Implementation Strategies

• Bottom-Up Approach: Grassroots effort led by systems administrators, lacking organization-wide support.

• Top-Down Approach: Management-led initiatives that determine project goals and accountability, resulting in greater success.

Systems Development Life Cycle (SDLC)

• A structured methodology for developing security systems comprising six phases:

  1. Investigation

  2. Analysis

  3. Logical Design

  4. Physical Design

  5. Implementation

  6. Maintenance and Change

Security Systems Development Life Cycle (SecSDLC)

• Adapting SDLC phases to create a coherent program for designing specialized systems.

Role of Security Professionals

• Diverse roles are essential in an information security program:

  • Senior Management focuses on strategic planning.

  • Information Security Project Team includes policy developers, security professionals, administrators, and end-users.

Data Ownership and Community Structure

• Data Owner: Manages the security and use of specific data sets.

• Data Custodian: Oversees storage and protection.

• End Users: Work with data daily to fulfill organizational goals.

Security Integration: Art, Science, and Social Science

• Security as an art involves subjective approaches lacking universal rules.

• As a science, it encompasses technical, high-performance elements requiring structural designs.

• As a social science, it deals with user behavior affecting security practices.

Key Terms

• Critical terminologies include:

  • Access, Asset, Attack, Control, Exploit, Exposure, Hack, Object, Risk, Security Model, Vulnerability, and more.

Summary

• Information security is about balancing risk management with operational controls.

• It is vital to understand the evolution from computer security to comprehensive information security strategies.

• Organizations need layered security to manage access, protect information integrity, and mitigate threats effectively.