Information Security, Risk Assessment, and Social Engineering - Week 1.1 Information Security

Learning Objectives

• Analyze the importance of Information Security
• Distinguish the history of computer security and how it evolved into information security
• Define key terms and critical concepts of information security
• Inspect the phases of the security systems development life cycle
• Elaborate the information security roles of professionals within an organization
• Explain why a successful information security program is the responsibility of both an organization’s general management and IT management.

Information

• Information is an asset that has value to an organization and needs protection.
• $BS\ ISO\ 27002:2005$: A British, European, and International Standard for information security.

Information Life Cycle

• Creation and capture
• Classification and Categorization
• Storage and management
• Use, sharing, and collaboration
• Archiving and retention
• Disposition and deletion

Benefits of Understanding the Information Life Cycle

• Helps organizations make the most of their information.
• Improves the security, efficiency, and compliance of information management processes.
• Helps policymakers evaluate and design information systems.

Information Types

• Printed or written on paper
• Stored electronically
• Transmitted by post or using electronics means
• Shown on corporate videos
• Displayed / published on web
• Verbal – spoken in conversations

Information Security

• The quality or state of being secure and free from danger.
• Achieved using several strategies simultaneously or in combination.
• Essential to protect vital processes and the systems that provide those processes.
• Security is something you do, not something you buy.
• The architecture is an integrated combination of appliances, systems and solutions, software, alarms, and vulnerability scans working together and monitored 24x7.
• Involves People, Processes, Technology, Policies, and Procedures (PPT).
• Computers and digital devices are integral to conducting business, making them targets of attack.
• Devices and networks that computers and devices use should be secured.

CIA Triad

• Confidentiality: Restrict access to authorized individuals.
• Integrity: Data has not been altered in an unauthorized manner.
• Availability: Information can be accessed and modified by authorized individuals in an appropriate timeframe.

Tools for Information Security

• Authentication
• Access Control
• Encryption
• Passwords
• Backup
• Firewalls
• Virtual Private Networks (VPN)
• Physical Security
• Security Policies

Authentication

• Verifying that persons accessing the information are who they say they are.
• Factors of identification:
  • Something you know – user ID and password
    • User ID identifies you, while the password authenticates you.
    • Easy to compromise if weak password.
  • Something you have – key or card
    • Can be lost or stolen.
  • Something you are – physical characteristics (i.e., biometrics)
    • Much harder to compromise.
• A combination of at least 2 factors is recommended.

Access Control

• Providing access only to information necessary to perform job duties after authentication.
• Methods:
  • Access control list (ACL) created for each resource (information).
    • List of users that can read, write, delete or add information.
    • Difficult to maintain all the lists.
  • Role-based access control (RBAC)
    • Users are assigned to roles.
    • Roles define what they can access.
    • Simplifies administration.

Encryption

• An algorithm (program) encodes or scrambles information during transmission or storage.
• Decoded/unscrambled by only authorized individuals to read it.
• How it works:
  • Both parties agree on the encryption method (there are many) using keys.
  • Symmetric key – sender and receiver have the key which can be risky.
  • Public Key – use a public and private key where the public key is used to send an encrypted message and a private key that the receiver uses to decode the message.

Passwords

• Single-factor authentication (user ID/password) is the easiest to break.
• Password policies minimize this risk by requiring:
  • A certain length to make it harder to guess.
  • Contain certain characters – such as upper and lower case, one number, and a special character.
  • Changing passwords regularly and do not allow a password to be reused.
  • Employees do not share their password.
  • Notifying the security department if they feel their password has been compromised.
  • Yearly confirmation from employees that they understand their responsibilities.

Backup

• Important information should be backed up and stored in a separate location.
• Very useful if the primary computer systems become unavailable.
• A good backup plan requires:
  • Understanding of the organizational information resources.
  • Regular backups of all data.
  • Offsite storage of backups.
  • Test of the data restoration.
• Complementary practices:
  • UPS systems.
  • Backup processing sites.

Firewalls

• Can be a piece of hardware and/or software.
• Inspects and stops packets of information that don’t apply to a strict set of rules.
• Operate inbound and outbound.
• Hardware firewalls are connected to the network.
• Software firewalls run on the operating system and intercepts packets as they arrive at a computer.
• Can implement multiple firewalls to allow segments of the network to be partially secured to conduct business.
• Intrusion Detection Systems (IDS) watch for specific types of activities to alert security personnel of potential threats.

Virtual Private Networks (VPN)

• Some systems can be made private using an internal network to limit access to them.
• Can’t be accessed remotely and are more secure.
• Requires specific connections such as being onsite.
• VPN allows users to remotely access these systems over a public network like the Internet.
• Bypasses the firewall.
• Encrypts the communication or the data exchanged.
• Example: CPP students have this ability for:
  • Exchange services from your Outlook client
  • Mapping a drive or mounting a file share
  • Instructions to establish a VPN connection can be found at https://ehelp.wiki.cpp.edu/VPN(VirtualPrivate_Network):

Physical Security

• Protection of the actual equipment.
• Includes hardware and networking components.
• Organizations need to identify assets that need to be physically secured:
  • Locked doors.
  • Physical intrusion detection - e.g., using security cameras.
  • Secured equipment.
  • Environmental monitoring - temperature, humidity, and airflow for computer equipment.
  • Employee training.

Security Policies

• Starting point in developing an overall security plan.
• Formal, brief, and high-level statement issued by senior management.
• Guidelines for employee use of the information resources.
• Embraces general beliefs, goals, objectives, and acceptable procedures.
• Includes company recourse if employees violate the policy.
• Security policies focus on confidentiality, integrity, and availability.
• Includes applicable government or industry regulations.
• Bring Your Own Device (BYOD) policies for mobile devices, governing use when accessing/storing company information and addressing intellectual property implications.
• Difficult to balance the need for security and users’ needs.

Personal Information Security

• Simple steps that individuals can take to be more secure:
  • Keep your software up to date.
  • Install antivirus software.
  • Use public networks carefully.
  • Backup your data.
  • Secure your accounts with two-factor authentication.
  • Make your passwords long, unique, and strong.
  • Be suspicious of strange links and attachments.
• For more information on personal information security, visit the Stop, Think, Connect website at http://www.stopthinkconnect.org/

Week 1.1 Summary

• Identified the information security triad.
• Identified and understand the high-level concepts surrounding information security tools.
• How to secure yourself digitally.