Accg

Week 1

The Importance of Information Assurance (IA)

• Definition: Protecting and managing information to ensure its confidentiality, integrity, and availability (CIA).

• Techniques: Includes risk assessment, data protection, and incident response.

Case Study: Australian Red Cross Data Leak (2016)

• Incident: A significant data breach compromising personal information of over 550,000 blood donors.

• Cause: Misconfiguration in a web server.

• Lesson: Highlights the importance of robust information security measures and proactive protection of sensitive data.

IA Strategy Principle

1. Holistic Approach: Covers technology, processes, and people.

2. Inclusive Mechanisms: Includes prevention, detection, response, and recovery.

3. Security Across Domains: Spans physical security to cyber and network security.

Embracing Independence in IA

1. Flexibility and Vendor Neutrality: Adapt and evolve strategies freely.

2. Merit-Based Solution Evaluation: Critical evaluation based on merit.

3. Advocating for Open Standards: Encourages interoperability and sharing of best practices.

Legal and Regulatory Requirements

• Understanding Laws and Standards: Knowledge of GDPR, HIPAA, NIST.

• Compliance as Strategy Cornerstone: Shapes IA strategy and practices.

• Consequences of Non-Compliance: Legal penalties, financial losses, erosion of customer trust.

Living Document

• Regular Updates: To address changing threats and business objectives.

• Feedback Loops: For continuous improvement.

• Stakeholder Engagement: Ensuring relevancy to meet needs.

Risk-Based Approach

1. Risk Identification, Analysis, and Evaluation: Comprehensive processes to uncover and assess risks.

2. Strategic Prioritization of Resources: Address highest risks first.

3. Engaging in Risk Management: Focus on mitigating risks to acceptable levels.

Organizational Significance

1. Strategic Planning and Operations: IA as a key component.

2. Alignment with Business Objectives: Supports and advances goals.

3. Competitive Advantage: Effective IA practices safeguard proprietary information.

Strategic, Tactical, and Operational

• Strategic Level: Define vision, policy, governance.

• Tactical Level: Plan and implement IA measures.

• Operational Level: Manage and execute IA controls.

Concise, Well-Structured, and Extensible

1. Conciseness: Straightforward and understandable documentation.

2. Well-Structured: Logical organization for easy navigation.

3. Extensibility: Accommodates future growth and changes.

Protecting Sensitive Assets

• Prioritizing Risks: Identify critical assets and align IA strategies.

• Effective IA Strategy: Protects assets, ensures compliance, conducts thorough audits.

Flashcards

Front: What is Information Assurance (IA)? Back: The practice of protecting and managing information to ensure its confidentiality, integrity, and availability (CIA).

Front: What incident highlighted the importance of robust information security measures? Back: The Australian Red Cross data leak in 2016, which compromised the personal information of over 550,000 blood donors.

Front: What are the key principles of an IA strategy? Back: Holistic approach, inclusive mechanisms, security across domains.

Front: What is meant by "Embracing Independence in IA"? Back: Flexibility and vendor neutrality, merit-based solution evaluation, advocating for open standards.

Front: Why is understanding laws and standards crucial in IA? Back: It shapes IA strategy and practices and ensures compliance to avoid legal penalties and financial losses.

Front: What should a living IA document include? Back: Regular updates, feedback loops, stakeholder engagement.

Front: What are the steps in a risk-based approach in IA? Back: Risk identification, analysis, and evaluation; strategic prioritization of resources; engaging in risk management.

Front: How does IA align with business objectives? Back: It supports and advances organizational goals and contributes to competitive advantage.

Front: What levels should a comprehensive IA approach involve? Back: Strategic, tactical, and operational levels.

Front: What characteristics should IA documentation have? Back: Concise, well-structured, and extensible.

Front: How does an effective IA strategy protect sensitive assets? Back: By prioritizing risks, ensuring compliance, conducting thorough audits, and leveraging IA for competitive advantage.

Week 2

Navigating Cybersecurity in the Digital Age

• The digital age has increased cybersecurity threats, necessitating robust strategies to protect data assets.

• The MSR Model of Information Assurance is a key framework for enhancing organizational resilience against cyber threats.

Understanding Information Assurance

• Information Assurance (IA) is essential for proactively managing risks in information systems.

• IA ensures security and integrity throughout the entire lifecycle of information.

Information Assurance Model Evolution

• CIA Triad: Focuses on maintaining confidentiality, integrity, and availability of information.

• McCumber's Cube: Builds on the CIA triad for a comprehensive security framework.

• MSR Model: A holistic approach integrating technology, policies, and people for a resilient security posture.

Key Terms Distinction

• Information Assurance: Ensures the reliability of data.

• Information Security: Protects information from threats.

• Information Protection: Shields both digital and non-digital assets.

• Cybersecurity: Defends against cyber threats.

Information Assurance Principles

1. Be a business enabler.

2. Protect the interconnecting elements of an organization’s systems.

3. Be cost-effective and cost-beneficial.

4. Establish responsibilities and accountability.

5. Require a robust method.

6. Be assessed periodically.

7. Be restricted by social obligations.

Information Assurance as a Business Enabler

• IA safeguards and empowers business operations, driving innovation and strategic initiatives.

• It protects organizational systems, ensuring strategic growth and competitiveness.

Cost-Effective and Beneficial

• Strategic investment in IA prevents costly cyber incidents and enhances operational efficiency.

Shared Responsibilities

• A collaborative culture among system owners, users, and IT teams ensures robust security measures.

Robust and Periodically Reassessed Approach

• Continuous reassessment of IA practices is necessary due to the evolving cyber threat landscape.

Ethical and Effective IA Strategies

• Balancing security measures with social obligations and compliance is key to maintaining ethical standards.

Operational Continuity and Resilience

• Comprehensive security strategy ensures the integrity of critical information assets and aligns with organizational goals.

Staying Secure and Compliant

• Regular assessments and updates are crucial for adapting to new threats and maintaining trust.

Strategic Information Assurance

• Adopting the MSR model and its principles helps organizations craft a strategic approach to IA, ensuring security measures protect assets while supporting business objectives.

Flashcards

Front: What is the MSR Model of Information Assurance? 

Back: A holistic framework integrating technology, policies, and people to enhance organizational resilience against cyber threats.

Front: What does Information Assurance (IA) ensure?

Back: The security and integrity of information throughout its entire lifecycle.

Front: What are the three aspects emphasized by the CIA Triad? 

Back: Confidentiality, Integrity, and Availability.

Front: How does the MSR Model build on McCumber's Cube? 

Back: It introduces a comprehensive approach to protecting digital assets, integrating technology, policies, and people.

Front: What is the difference between Information Security and Cybersecurity? 

Back: Information Security focuses on the CIA triad of information, while Cybersecurity concentrates on protecting electronic information from unauthorized access or attacks.

Front: Name two principles of Information Assurance. 

Back: Be a business enabler, Protect the interconnecting elements of an organization’s systems.

Front: How does IA serve as a business enabler? 

Back: It safeguards and empowers business operations, driving innovation and strategic initiatives.

Front: Why is strategic investment in IA cost-effective? 

Back: It prevents costly cyber incidents and enhances operational efficiency.

Front: What is essential for a robust and periodically reassessed approach to IA? 

Back: Continuous reassessment of IA practices due to the evolving cyber threat landscape.

Front: How should IA strategies balance security and social obligations? 

Back: By maintaining ethical standards and meeting regulatory demands.

Front: What ensures operational continuity and resilience in IA? 

Back: A comprehensive security strategy that aligns with organizational goals.

Front: Why are regular assessments and updates crucial in IA? 

Back: They help adapt to new threats and maintain trust.

Front: How does adopting the MSR model benefit organizations? 

Back: It helps craft a strategic approach to IA, ensuring security measures protect assets while supporting business objectives.

Week 3

Introduction to Information Security Management System (ISMS)

• Focus on Risk: Identification, ownership, assessment, mitigation, policy and process, acceptance.

• Holistic Approach: Integration with other management systems and standards.

• Alignment: With frameworks like NIST and CobiT.

• Supports: Legal, regulatory, and contractual requirements such as HIPAA and PCI.

Risk Methodology

1. Identifying Risks: Analyzing internal and external factors.

2. Assessing Probability: Evaluating likelihood based on historical data and expert judgment.

3. Impact Analysis: Prioritizing risks based on potential consequences.

Risk Process

1. Establish Context: Identify people, technology, interested parties, and information assets.

2. Determine Impact and Probability Criteria

3. Identify Risks

4. Evaluate Risk

5. Treat or Not Treat the Risk: Mitigation.

6. Management and Approval of Residual Risk

7. Communicate

8. Improve

9. Monitor

ISMS Cycle: Plan-Do-Check-Act

• Plan: Define scope, document policy, systematic risk assessment, identify and evaluate risks, determine risk treatment, prepare SOA.

• Do: Implement and operate methods to measure control effectiveness, develop risk treatment plan, implement procedures for incident detection, operate selected controls, conduct training.

• Check: Monitor and review procedures, measure control effectiveness, reassess risks, conduct internal audits, record actions impacting ISMS.

• Act: Implement improvements, communicate results, ensure objectives are met.

Security and Privacy in Technology

• Key Topics: Security and privacy across technology areas.

• Collaboration: With industry organizations.

• Crossing Technology Areas: Including cloud computing, healthcare, IoT, and telecom.

Key Security Products and Standards

• COSO Framework: Enterprise risk management.

• ISO/IEC 27001: Information Security Management System (ISMS).

• ISO/IEC 27000 Family: Standards for information security.

• Other Standards: ISO/IEC 18033 (encryption), ISO/IEC 7811 (ID cards), ISO/IEC 2382-37 (biometrics vocabulary).

Understanding ISO/IEC 27001:2013

• Internationally Recognized: Standard for information security.

• Family of Standards: Integrates with other management systems.

• Auditable/Certifiable Framework: With 'shall' requirements.

• Aligned with Annex SL: For terminology and structure.

ISO/IEC 27000 Family Relationship

• 27000: Fundamentals and vocabulary.

• 27001: Requirements.

• 27002: Code of practice.

• 27003: Implementation guidance.

• 27004: Security metrics and measurement.

• 27005: Risk management.

• 27006: Audit and certification requirements.

Vertical Topic Areas

• Cloud Computing: ISO/IEC 27017, 27018, 27036-4.

• Healthcare: ISO/IEC 27999.

• Telecom: ISO/IEC 27011.

• Societal Considerations: ISO/IEC 27032 for cybersecurity.

In Progress and Future Work Areas

• Cyber Insurance, Cyber Resilience, Cloud Computing: SLA for security and privacy.

• Trusted Connections, Virtualization, Big Data: Security and privacy considerations.

• IoT, Identity Management, Smartphone Apps: Privacy implications.

Compliance and Legal Frameworks

• HIPAA, PCI DSS, NIST 800-53: Standards for specific industries.

• FedRAMP, FAR/DFAR: Federal mandates for cloud services and data protection.

Annex A of ISO/IEC 27001:2013

• Security Controls: Organized into functions for customizable implementation.

• Key Controls: Information security policies, access control, cryptography, operations security, compliance.

Security Considerations for Asset Life

• Entire Life Cycle: Including planning, acquisition, operation, maintenance, and disposal phases.

Flashcards

Front: What is the focus of an Information Security Management System (ISMS)? 

Back: Risk identification, ownership, assessment, mitigation, policy and process, and acceptance.

Front: What are the three steps in risk methodology? 

Back: Identifying risks, assessing probability, and conducting impact analysis.

Front: Name the first three steps in the risk process. 

Back: Establish context, determine impact and probability criteria, and identify risks.

Front: What is the "Plan" phase in the ISMS cycle? 

Back: Defining scope, documenting policy, systematic risk assessment, identifying and evaluating risks, determining risk treatment, preparing SOA.

Front: What activities are involved in the "Do" phase of ISMS? 

Back: Implementing and operating methods to measure control effectiveness, developing a risk treatment plan, implementing incident detection procedures, operating selected controls, conducting training.

Front: Describe the "Check" phase in the ISMS cycle. 

Back: Monitoring and reviewing procedures, measuring control effectiveness, reassessing risks, conducting internal audits, recording impactful actions.

Front: What is done in the "Act" phase of ISMS? 

Back: Implementing improvements, communicating results, ensuring objectives are met.

Front: What are the key vertical topic areas for ISMS? 

Back: Cloud computing, healthcare, IoT, societal considerations, telecom.

Front: Name two key standards related to information security. 

Back: ISO/IEC 27001 (Information Security Management System), COSO Framework (enterprise risk management).

Front: What does Annex A of ISO/IEC 27001:2013 provide? 

Back: A detailed set of security controls for improving information security posture.

Front: What are the phases in the security consideration for asset life cycle? 

Back: Planning, acquisition, operation, maintenance, and disposal.

Front: What is the significance of ISO/IEC 27001:2013?

Back: It is an internationally recognized standard for information security management, integrating with other management systems and being auditable and certifiable.

Front: What is the relationship between ISO/IEC 27000 family standards?

 Back: 27000: Fundamentals and vocabulary, 27001: Requirements, 27002: Code of practice, 27003: Implementation guidance, 27004: Security metrics and measurement, 27005: Risk management, 27006: Audit and certification requirements.

Front: What are the compliance and legal frameworks discussed?

 Back: HIPAA, PCI DSS, NIST 800-53, FedRAMP, FAR/DFAR.

Week 4

Summary

Introduction to Planning for Security

• Focus on the importance of strategic planning in information security.

• Identify key roles and responsibilities in the planning process.

Strategic Thinking

• Emphasizes the importance of planning and anticipating potential threats to gain a competitive edge.

Outline

1. Role of Planning: Identifying roles in organizations active in the planning process.

2. Precursors to Planning: Values statement, vision statement, mission statement.

3. Strategic Planning: Involves the Chief Information Security Officer (CISO).

4. Creating a Strategic Plan: Planning for information security implementation.

Objectives

• Identify organizational roles in the planning process.

• Understand components of information security system implementation planning.

Planning is Driven By

• Employees, management, stockholders, outside stakeholders.

• Physical, political, legal, competitive, and technological environments.

Information Security Professionals

• CIO: Manages and implements information security initiatives.

• CISO: Establishes and maintains the enterprise vision, strategy, and program for information security.

• Security Managers: Oversee daily operations of the information security program.

• Security Technicians: Implement and maintain technical security controls.

• Data Owners: Responsible and accountable for organizational data.

• Data Custodians: Store, maintain, and protect data.

• Data Users: Authorized access to data for job performance.

Planning Definition

• Creating action steps toward goals and controlling them.

• Provides direction, manages resources, optimizes use, and coordinates efforts.

Precursors to Planning

• Values Statement: Principles and benchmarks of the organization.

• Vision Statement: Ambitious future goals and best-case scenarios.

• Mission Statement: Organization’s business scope and strategic approach.

Strategic Planning

• Lays out long-term organizational direction.

• Includes mission, vision, values statements, and coordinated plans for subunits.

Creating a Strategic Plan

• General strategy development.

• Specific strategic plans for major divisions.

• Translates strategic goals into specific objectives.

Planning Levels

• Strategic Planning: Five or more year focus.

• Tactical Planning: One to three year focus, breaking strategic goals into incremental objectives.

• Operational Planning: Day-to-day task performance, including coordination across departments.

Strategic Plan Elements

• Introduction by senior executive, executive summary, mission and vision statements.

• Organizational profile, strategic issues, program goals, management goals.

• Appendices may include SWOT analyses, surveys, budgets.

10 Tips for Strategic Planning

1. Create a compelling vision statement.

2. Use a balanced scorecard approach.

3. Deploy a draft high-level plan early, gather stakeholder input.

4. Make the evolving plan visible.

5. Make the process invigorating.

6. Be persistent.

7. Make the process continuous.

8. Provide meaning.

9. Be yourself.

10. Have fun.

Planning for InfoSec Implementation

• CISO typically reports to CIO.

• CISO translates strategic plan into tactical and operational information security plans.

• Bottom-Up Approach: Individual administrators improve security without coordinated planning.

• Top-Down Approach: Strong upper management support, assured funding, clear planning, and ability to influence organizational culture.

Flashcards

Front: What are the key precursors to planning in information security? Back: Values statement, vision statement, mission statement.

Front: Who are the main information security professionals involved in planning? Back: CIO, CISO, Security Managers, Security Technicians, Data Owners, Data Custodians, Data Users.

Front: What are the three levels of planning in information security? Back: Strategic planning (5+ years), tactical planning (1-3 years), operational planning (day-to-day tasks).

Front: What is the primary role of the Chief Information Security Officer (CISO)? Back: Establish and maintain the enterprise vision, strategy, and program for information security.

Front: What is the difference between the bottom-up and top-down approaches to security implementation? Back: Bottom-up lacks coordinated planning and funding; top-down has strong management support, assured funding, and clear planning.

Front: Why is strategic thinking important in information security? Back: It helps anticipate potential threats and gain a competitive edge by ensuring the success of security initiatives.

Front: What are the key elements of a strategic plan? Back: Introduction, executive summary, mission and vision statements, organizational profile, strategic issues, program goals, management goals, appendices.

Front: Name two tips for effective strategic planning. Back: Create a compelling vision statement, use a balanced scorecard approach.

Front: What drives the planning process in information security? Back: Employees, management, stockholders, outside stakeholders, and various environmental factors (physical, political, legal, competitive, technological).

Front: What are the roles of data owners and data custodians in information security? Back: Data owners are responsible for data within the organization; data custodians are responsible for storing, maintaining, and protecting data.

Week 5

Introduction to Information Asset and Risk Management

• Strategy Importance: A clear strategy sets the tone for risk appetite and success.

• Quotes on Strategy: Emphasize the importance of planning and measurement in achieving goals.

IT Asset Management Standards

• Classification System: Minimize risks and achieve strategic objectives.

• Secure IT Assets: Expand beyond traditional assets to information assets for comprehensive risk management.

Types of Assets

• Tangible Assets: Physical presence, crucial for operational value.

• Intangible Assets: Non-physical, such as reputation and intellectual property.

Asset Management Responsibilities

1. Inventory Listing: Catalog all organizational assets.

2. Assign Ownership: Designate individuals responsible for asset protection.

3. Acceptable Use Policies: Establish guidelines for asset use.

Importance of Asset Inventory

1. Detailing Location: Baseline for protection.

2. Licensing Documentation: Vital details for decision-making.

3. Classification Categorization: Systematic categorization for effective protection.

Asset Management Life Cycle

1. Planning: Align IT assets with business processes.

2. Acquisition: Cost-effective acquisition strategies.

3. Deployment: Methods for deploying assets (pilot, staged, big bang).

4. Operation/Maintenance: Meet financial obligations and manage operational risks.

5. Disposal: Ecologically responsible and meets contractual obligations.

Strategy Behind Information Classification

• Strategic Differentiation: Organize information by sensitivity and criticality for cost-effective protection.

• Resource Allocation: Align resources with risk profile and importance of information.

Implementing Classification Guidelines

• Centralized Function: Ensures consistency and uniformity across the organization.

• Decentralized Function: Provides flexibility but may lead to inconsistency.

Information Labeling and Handling Protocols

• Labeling Protocol: Design protocols affecting handling, storage, and access.

• Standardized Classification Levels: Guide secure processing, storage, and sharing of information.

NIST Guidelines on Information Classification

• Confidentiality: Level of sensitivity.

• Integrity: Data accuracy and trustworthiness.

• Availability: Accessibility and uptime.

IT Asset Maturity Model

• Chaos to Excellence: Understanding current maturity level helps in mapping out improvement paths.

• Process Maturity Levels: Chaos, Reactive, Active, Proactive, Center of Excellence.

Risk Management Process Overview

1. Background Planning: Define aim, scope, and boundaries.

2. Asset Analysis: Identify and value assets.

3. Threat Analysis: Identify potential harm sources.

4. Vulnerability Analysis: Spot weaknesses in defenses.

Risk Treatment

• Avoiding, Reducing, Transferring, Accepting Risk: Strategies to manage identified risks.

Monitoring Risks

• Regular Reviews: Monitor risk environment and control measures.

• Key Risk Indicators (KRIs): Signal when risk levels approach unacceptable thresholds.

Integration with Other Management Practices

• Budgeting, Business Planning, Internal Audit, Periodic Reporting: Align risk management with organizational practices.

Reality of Ignoring Risks

• Consequences: Financial losses, reputational damage, operational disruptions.

Encouraging Risk Reporting

• Risk Submission Form: Simplify reporting and ensure it is assessed correctly.

Managing Risks

• Risk Register: Record, describe, assess, and manage risks.

Flashcards

Front: What are the two types of assets in asset management? Back: Tangible assets (physical presence) and intangible assets (reputation, intellectual property).

Front: What is the purpose of an asset inventory? Back: To act as a baseline for protection, provide vital asset details for decision-making, and ensure systematic categorization for effective protection.

Front: What are the stages of the asset management life cycle? Back: Planning, acquisition, deployment, operation/maintenance, and disposal.

Front: What is strategic differentiation in information classification? Back: Organizing information by sensitivity and criticality for cost-effective protection.

Front: What is the purpose of implementing classification guidelines centrally? Back: To ensure consistency and uniformity across the organization.

Front: What are the key aspects of NIST guidelines on information classification? Back: Confidentiality (sensitivity), integrity (data accuracy), and availability (accessibility).

Front: What are the maturity levels in the IT Asset Maturity Model? Back: Chaos, Reactive, Active, Proactive, Center of Excellence.

Front: What are the four steps in the risk management process overview? Back: Background planning, asset analysis, threat analysis, vulnerability analysis.

Front: What are the four strategies for risk treatment? Back: Avoiding risk, reducing risk, transferring risk, accepting risk.

Front: What are Key Risk Indicators (KRIs)? Back: Indicators that signal when risk levels are approaching unacceptable thresholds.

Front: What are the consequences of ignoring risks? Back: Financial losses, reputational damage, operational disruptions.

Front: What should be recorded in a risk register? Back: Description of the risk, likelihood, impact, risk rating, mitigation plan, and contingency position.

Week 6

Information Assurance in System Development & Acquisition

Recap of Last Week:

• Risk analysis involves assessing the impact and prioritizing risks.

• Risk treatment includes designing controls.

• Monitoring involves documenting results and overseeing risks and controls.

People as Assets:

• Tangible and intangible assets are crucial.

• Human error causes 95% of cybersecurity breaches.

Benefits of Security in System Development:

1. Early identification and mitigation of vulnerabilities.

2. Awareness of engineering challenges.

3. Shared security services and strategies.

4. Informed executive decision-making.

5. Documented security decisions.

6. Improved confidence and adoption of systems.

7. Better system understanding and integration.

Traditional SDLC:

1. Requirements Gathering: Understand customer needs, establish scope, identify stakeholders and process gaps.

2. Design: Architecture reviews, threat modeling, and identifying design flaws early.

3. Implementation: Code reviews, secure coding standards, and defect management.

4. Verification/Testing: Comprehensive testing, including security testing.

5. Deployment/Maintenance: Monitor systems, manage changes, incidents, and upgrades.

Infusing Security in SDLC:

• Incorporate security from the beginning.

• Use maturity models like BSIMM.

• Educate personnel on software security.

• Assign responsibility for software security.

• Establish a comprehensive risk management process.

Physical and Environmental Security Controls:

• Importance of physical security to protect networks and components.

• Common controls include locking server rooms, setting up surveillance, securing vulnerable devices, and using rackmount servers.

• Consider securing printers, maintaining HVAC systems, and having a secure disposal plan.

Flashcards

Front: What are the key benefits of incorporating security considerations in system development? Back: Early identification and mitigation of vulnerabilities, awareness of engineering challenges, shared security services, informed executive decision-making, documented security decisions, improved confidence, and better system integration.

Front: What are the phases of the Traditional SDLC? Back: Requirements gathering, design, implementation, verification/testing, and deployment/maintenance.

Front: Why is it important to incorporate security from the beginning of the SDLC? Back: It minimizes the 'test-patch-retest' cycle, integrates best practices, ensures proper security design, and aligns with budget and scheduling goals.

Front: What are some physical security controls for IT assets? Back: Locking server rooms, setting up surveillance, securing vulnerable devices, using rackmount servers, securing printers, and maintaining HVAC systems.

Front: How can human error impact cybersecurity? Back: Human error causes 95% of cybersecurity breaches.

Front: What are the key steps in the SDLC phase of implementation? Back: Carry out code reviews, follow secure coding standards, and manage defects effectively.

Front: What is the role of the CISO in integrating security into the SDLC? Back: The CISO oversees the incorporation of security measures, educates personnel, assigns security responsibilities, and ensures a comprehensive risk management process.

Front: What should a deployment plan include in the SDLC phase of deployment/maintenance? Back: The deployment environment details, steps for configuration and launch, change management process, rollback plans, and disaster recovery requirements.

Front: Why is physical security important in IT asset management? Back: To prevent unauthorized access, damage, theft, and ensure the integrity and availability of information systems.

Front: What should be included in a secure disposal plan for IT assets? Back: Policies for offsite and onsite technology use, clear desk policy, professional shredding of documents, and complete destruction of sensitive information.

Week 8

Information Assurance Awareness, Training, and Education (AT&E)

Goals of Security:

• Ensure the right person has the right information at the right time.

• Prevent unauthorized access and ensure data is only available to authorized individuals.

Today's Goals:

1. Purpose of Security Training

2. Potential Threats

3. Protecting Data at Work

4. Mobile Device Security

5. Exploring Security Policies

Responsibility for Computer Security:

• Everyone is responsible for protecting information.

• Act responsibly and ethically.

• Comply with policies and laws.

Purpose of AT&E:

1. Ensure effective implementation of information assurance policies.

2. Cultivate a strong information assurance culture.

3. Emphasize the importance of protecting information assets.

4. Encourage additional education on information assurance.

5. Promote information assurance consciousness in daily tasks.

6. Highlight management’s support for information assurance.

7. Inform about risks and controls.

Importance of Learning About Security:

• 10% of security safeguards are technical; 90% rely on user adherence to good practices.

• Users play a crucial role in ensuring system security.

Potential Security Threats:

• Malicious Software (Malware): Includes viruses, worms, Trojan horses, and spyware.

• Password Attacks: Guessing, stealing, dictionary attack, brute force attack.

• Social Network Attacks: Evil twin, clickbaiting, clickjacking, drive-by download.

• Wireless Threats: Evil twins, unsecured networks.

• Physical Security Threats: Hardware destruction, theft, keyloggers.

• Identity Theft: Unauthorized use of personal information for criminal purposes.

• Social Engineering: Manipulation to obtain confidential information.

Protecting Against Password Attacks:

• Use multi-factor authentication (MFA).

• Use a password manager.

• Change passwords often.

• Use strong, random passwords.

Protecting Data:

• Use strong passwords.

• Pay attention to computer security.

• Use email safely.

• Use the Internet responsibly and securely.

• Dispose of media properly.

• Physically secure devices containing personal information.

Mobile Device Security Tips:

• Lock laptops with a metal cable.

• Guard mobile devices at all times.

• Implement a password-protected screen lock.

• Avoid storing sensitive information on the device.

• Back up data on a PC or server.

• Store important data separately on removable media.

Policies:

1. Acceptable Use Policy

2. User Account Policy

3. Password Policy

4. Email Access Policy

5. Shared Calendar Policy

6. Mobile Device Policy

7. Remote Access Policy

Flashcards

Front: What are the primary goals of security in information assurance? Back: Ensure the right person has the right information at the right time and prevent unauthorized access.

Front: What is the 90/10 Rule in security safeguards? Back: 10% of security safeguards are technical, and 90% rely on user adherence to good practices.

Front: Name two potential security threats. Back: Malicious software (malware) and password attacks.

Front: How can you protect against password attacks? Back: Use multi-factor authentication (MFA), a password manager, change passwords often, and use strong, random passwords.

Front: What are the key purposes of Information Assurance Training and Education (AT&E)? Back: Ensure effective implementation of policies, cultivate a strong information assurance culture, emphasize the importance of protecting information assets, encourage additional education, promote information assurance consciousness, highlight management’s support, and inform about risks and controls.

Front: What should you do to protect data at work? Back: Use strong passwords, pay attention to computer security, use email safely, use the Internet responsibly and securely, dispose of media properly, and physically secure devices containing personal information.

Front: What are some signs of malware? Back: Unusual items on the screen, corrupted files, slow program startup, increased pop-up ads, and changed settings that can't be reverted.

Front: What are some common social engineering techniques? Back: Impersonation, hoax, phishing, URL hijacking, spam, shoulder surfing, dumpster diving, tailgating.

Front: Why is it important to dispose of media properly? Back: To ensure no unauthorized person can access data by ordinary means and to prevent information from being discovered and used for criminal purposes.

Front: Name three policies related to information assurance. Back: Acceptable Use Policy, Password Policy, Mobile Device Policy.

Week 9

Incident Handling

Overview:

1. Major Components: Identifying and managing security incidents.

2. Incident Handling Lifecycle: Stages from preparation to post-incident analysis.

3. Policy Development: Creating a clear incident response policy.

4. Incident Reporting: Documenting and analyzing incidents for future improvement.

Incidents:

• Definition: Violation or threat of violation of computer security policies.

• Examples: Denial of service attacks, malware infections, data breaches, ransomware.

Incident Handling Lifecycle (NIST 800-61 rev.2):

1. Preparation: Establishing incident response capabilities and policies.

2. Detection and Analysis: Identifying and understanding incidents.

3. Containment, Eradication, and Recovery: Managing the incident and restoring systems.

4. Post-Incident Analysis: Reviewing and learning from the incident.

Preparation:

• Components: Incident response policy, team, communication, compliance, hardware, software, and training.

Incident Response Policy:

• Outlines standard methods and benefits of incident handling.

• Helps management understand and prepare for incidents.

• Provides reassurance and reduces anxiety during crises.

Incident Response Team (IRT):

• Composed of cross-departmental members with specific roles and responsibilities.

• Coordinates with external stakeholders and performs incident-related tasks.

Supporting Team:

• Includes media relations, legal counsel, and law enforcement to manage communications and compliance.

Incident Communications:

• Inbound: Reports from asset owners, anonymous reports, help desk, self-audits.

• Outbound: Updates to affected individuals, IT staff, managers, and customers.

Compliance:

• Following laws, regulations, and contractual obligations.

• Example: GDPR requires reporting data breaches to authorities and stakeholders.

Hardware and Software:

• Tools for incident response, including backup devices, laptops, packet analyzers, and digital forensics software.

Training:

• Awareness of security aspects and procedures, including media relations.

Incident Management Stages (NIST):

1. Detection Methods: Visible changes, performance monitoring, log analysis, endpoint protection.

2. Analysis: Discovering adverse events and managing containment and eradication.

Incident Containment, Eradication, and Recovery:

• Containment: Preventing harm expansion, sometimes before analysis is complete.

• Eradication: Removing incident causes like malware.

• Recovery: Restoring systems to normal operation.

Post-Incident Analysis:

• Documenting incident details and identifying improvement areas.

• Sharing information with stakeholders and outlining future prevention measures.

Disaster Recovery (DR) and Business Continuity Planning (BCP):

• DR restores systems after a disaster.

• BCP ensures operations under adverse conditions.

• Key components include a business impact analysis, prioritization of critical assets, and training for data restoration.

Flashcards

Front: What are the major components of incident handling? Back: Identifying and managing security incidents, understanding the incident lifecycle, developing a response policy, and reporting for future improvement.

Front: What are the stages of the incident handling lifecycle according to NIST 800-61 rev.2? Back: Preparation, Detection and Analysis, Containment, Eradication, and Recovery, Post-Incident Analysis.

Front: What should an incident response policy include? Back: Standard methods for handling incidents, benefits of the policy, management understanding, and reassurance for users.

Front: What are the responsibilities of the Incident Response Team (IRT)? Back: Identifying threats, assessing risks, mitigating risks, notifying management and local personnel, and issuing final reports.

Front: What are the key components of incident communication? Back: Inbound (reports from various sources) and outbound (updates to affected individuals and stakeholders) communications.

Front: What is the importance of compliance in incident handling? Back: Following applicable laws, regulations, and contractual obligations to avoid penalties and ensure proper incident response.

Front: What are some essential tools for incident response? Back: Backup devices, laptops, packet analyzers, digital forensics software, and evidence-gathering accessories.

Front: What should be done during the containment phase of incident handling? Back: Preventing the expansion of harm, possibly disconnecting affected systems, and taking careful steps to manage the situation.

Front: Why is post-incident analysis important? Back: To document incident details, evaluate threat handling, identify areas for improvement, and outline future prevention measures.

Front: What is the difference between Disaster Recovery (DR) and Business Continuity Planning (BCP)? Back: DR focuses on restoring systems after a disaster, while BCP ensures operations continue under adverse conditions.

Front: What are some examples of detection methods for incidents? Back: Visible changes to services, performance monitoring, log analysis, and endpoint protection alerts.

Week 10

Digital Forensics

Overview:

• Digital forensics investigates incidents post-occurrence to understand the who, what, when, where, why, and how.

• ISO 27037 standard provides guidelines for handling digital evidence, including identification, collection, acquisition, and preservation.

Incident Response:

• Plan & Prepare: Develop an incident response plan and set up a team.

• Identify, Detect, and Report: Monitor systems and networks.

• Assessment and Decision: Formulate strategies to limit impact.

• Response: Remove incident causes, restore systems, and verify recovery.

• Lessons Learnt: Review and analyze the incident for future improvements.

Digital Forensics Process:

1. Collection: Systematically retrieve digital evidence.

2. Recovery: Apply scientific methods to analyze data.

3. Analysis: Interpret evidence to draw conclusions.

4. Presentation: Document findings in a structured report for legal proceedings.

Examples of Incidents Requiring Digital Forensics:

1. Data breaches

2. Insider threats

3. Malware analysis

4. Phishing attacks

5. Denial of Service (DoS) attacks

6. Ransomware cases

7. Intellectual property theft

Types of Investigations:

• Internal: Understanding incidents and restoring operations.

• Law Enforcement Support: Directly aiding law enforcement efforts.

Tools and Techniques:

• Autopsy: An open-source digital forensics platform with modules for hash lookup, file type identification, EXIF metadata extraction, registry analysis, data carving, and geolocation.

Typical Investigation Phases:

1. Identification: Recognize and prioritize evidence collection.

2. Collection: Gather and transport digital devices for analysis.

3. Acquisition: Create duplicate copies to preserve original evidence.

4. Preservation: Maintain evidence integrity and establish a chain of custody.

5. Analysis: Determine contraband material, reconstruct events, and identify system compromises.

6. Presentation: Communicate findings in understandable terms.

Challenges in Digital Forensics:

• Time Issues: Handling and interpreting time-related information across different systems.

• File Deletion and Steganography: Recovering deleted files and detecting hidden data.

• Compromised Systems: Comparing against known good states and identifying anomalies.

Future in Digital Forensics:

• Standards and Certification: Developing standardized procedures and certifications for investigators and tools.

• Research and Development: Enhancing audit data integrity, privacy, and detection techniques with AI and machine learning.

Flashcards

Front: What is the main purpose of digital forensics? Back: To investigate incidents post-occurrence, understand the details of the incident, and preserve digital evidence.

Front: What are the key components of incident response? Back: Plan & Prepare, Identify, Detect and Report, Assessment and Decision, Response, and Lessons Learnt.

Front: What are the four primary phases of the digital forensics process? Back: Collection, Recovery, Analysis, and Presentation.

Front: Give two examples of incidents requiring digital forensics. Back: Data breaches and malware analysis.

Front: What is the role of Autopsy in digital forensics? Back: Autopsy is an open-source digital forensics platform used for data recovery, timeline analysis, keyword searching, internet activity analysis, and more.

Front: What are the stages of a typical digital forensics investigation according to NIST and ISO/IEC guidelines? Back: Identification, Collection, Acquisition, Preservation, Analysis, and Presentation.

Front: What is the importance of preserving digital evidence? Back: To maintain its integrity and admissibility in legal proceedings by establishing a chain of custody.

Front: What are some challenges faced in digital forensics? Back: Handling time-related information, recovering deleted files, detecting hidden data, and identifying anomalies in compromised systems.

Front: What are future directions in digital forensics? Back: Developing standards and certifications, enhancing audit data integrity, privacy, detection techniques, and leveraging AI and machine learning.

Front: What is the purpose of the presentation phase in digital forensics? Back: To document and communicate findings in a structured report, making complex technical details understandable for legal proceedings.

Week 11

Business Continuity and Disaster Recovery Planning

Overview:

• Critical aspects of planning to ensure organizational resilience and continuity during disruptive events.

• Importance highlighted by case study on COVID-19's impact on Australia.

Definitions:

• Disaster Recovery (DR): Focus on restoring critical IT systems and data within the first 30 days using solutions like hot site recovery.

• Business Continuity (BC): Ensuring the continuation of all essential business functions beyond 30 days, involving new equipment and buildings.

Key Components:

1. Disaster Recovery (DR):

   • Backup: Regular data and application backups.

   • Recovery Site: Secondary location for IT operations.

   • Recovery Time Objective (RTO): Targeted system recovery timeframe.

   • Recovery Point Objective (RPO): Acceptable data loss timeframe.

2. Business Continuity (BC):

   • Business Impact Analysis (BIA): Identifies critical functions and dependencies.

   • Risk Assessment: Evaluates potential threats and vulnerabilities.

   • Business Continuity Plan (BCP): Detailed plan for maintaining/resuming operations.

   • Crisis Management Team: Manages response and communication strategy.

Distinguishing BCP and DRP:

• Scope: BCP is organization-wide, DRP is IT-specific.

• Focus: BCP on critical functions, DRP on IT recovery.

• Timeframes: BCP for long-term, DRP for short-term.

ISO 22301 Objectives:

1. Protect against disruptions.

2. Reduce the likelihood of incidents.

3. Respond efficiently to incidents.

4. Recover quickly from disruptions.

5. Continuously improve plans.

PDCA (Plan-Do-Check-Act) and ISO 22301:

• Plan: Establish BCMS, identify internal/external issues, define scope, conduct BIA and risk assessment.

• Do: Implement strategies, develop BCPs, establish incident response.

• Check: Monitor and evaluate BCMS performance, conduct audits and reviews.

• Act: Address nonconformities, continuously improve BCMS.

Proper Framework for BCMS:

1. Management Commitment

2. Planning/Steering Committee

3. Risk Evaluation

4. Business Impact Analysis

5. Determine Recovery Strategy

6. Data Collection

7. Develop Emergency Operations Centre

8. Organise and Write Plan

9. Develop Test Criteria and Procedures

10. Awareness and Training

11. Exercise and Maintenance

12. Approval

Common Mistakes:

• No Business Impact Analysis

• Technology Focus

• Failure to Involve Business

• Overly Complex Documentation

• Lack of Training

• Reliance on Templates

Common Pitfalls:

• Lack of Understanding

• Compliance as a Mere Exercise

• Inadequate Planning

• False Sense of Security

• Procrastination

Basic Concepts:

• Readiness Assessment

• Critical Business Process Flow

• Identification of Critical Paths

• Integration of Technology and Business

• Minimize Decision Making

• Continuous Training

• Part of Change Management

Flashcards

Front: What are the main objectives of ISO 22301? Back: Protect against disruptions, reduce the likelihood of incidents, respond efficiently to incidents, recover quickly, and continuously improve plans.

Front: What is the focus of Disaster Recovery (DR)? Back: Restoring critical IT systems and data within the first 30 days.

Front: What is the focus of Business Continuity (BC)? Back: Ensuring the continuation of all essential business functions beyond 30 days.

Front: What are the key components of a Disaster Recovery Plan (DRP)? Back: Regular backups, secondary recovery site, Recovery Time Objective (RTO), and Recovery Point Objective (RPO).

Front: What are the key components of a Business Continuity Plan (BCP)? Back: Business Impact Analysis (BIA), risk assessment, detailed continuity plan, and crisis management team.

Front: What does PDCA stand for in the context of ISO 22301? Back: Plan-Do-Check-Act.

Front: What is the purpose of a Business Impact Analysis (BIA)? Back: To identify critical business functions and their dependencies.

Front: What are some common mistakes in business continuity and disaster recovery planning? Back: No Business Impact Analysis, technology focus, failure to involve the business, overly complex documentation, lack of training, and reliance on templates.

Front: What is the role of the Crisis Management Team in a BCP? Back: To manage the overall response and communication strategy during and after a disruption.

Front: What are some common pitfalls in business continuity planning? Back: Lack of understanding, viewing compliance as a mere exercise, inadequate planning, false sense of security, and procrastination.

Front: What is a Recovery Time Objective (RTO)? Back: The targeted timeframe for system recovery after a disruption.

Front: What is a Recovery Point Objective (RPO)? Back: The acceptable amount of data loss measured in time.

Front: What is the purpose of regular training in business continuity planning? Back: To ensure all employees understand their roles and responsibilities in maintaining business continuity.

Front: What is the importance of management commitment in BCMS? Back: Ensures top-down support, improves follow-through, and assists with communicating the importance of business continuity and disaster recovery planning.