INFORMATION SECURITY MANAGEMENT

1
INFORMATION SECURITY MANAGEMENT
MIS534
2
Course Outline Topics Covered

• Planning for Security and Contingencies
• Information Security Policy
• Developing Security Programs
• Security Management Models
• Risk Management
• Identifying
• Assessing
• Controlling

3
Course Outline Topics Covered

• Protection Mechanism
• Personnel and Security
• Law and Ethics
• Security and the Cloud

4
Classroom Procedures

• Most classes will contain the following
  components
• Current Events
• Lectures
• Case Studies
• Project Presentations
• Various Speakers
• Encourage student sharing their experiences

5
Course Structure

• Assessments (4) 40
• Case Study/Current Events 10
• Topic paper 20
• Demo/Hands-on Lab Project 20
• Health First Case Study 5
• Class Participation/Discussions 5

6
Topic Paper

• The primary purpose of this assignment is to
  provide you an opportunity to further develop
  practical research skills by investigating an
  information security and information assurance
  (IA) related topic (hopefully of personal
  interest).
• Consists of
• Executive summary of the topic ( 1000 1500
  words)
• include an annotated bibliography (with at least
  8 references)
• 15-20 minutes presentation of your executive
  summary to class.

7
Hands On/Lab Presentation

• Prepare a presentation (5-7 minutes) and a live
  demonstration or hands-on lab exercise (20-25
  minutes) on a security related technology.
• Consists of
• Student Handout
• Class Presentation
• Live Demonstration
• Annotated Bibliography of useful resources

8
Class Introductions/Expectations

• Name
• Background
• Course Expectations

9
Who I am

• Dr. Cummings
• Assistant Professor at UNCW
• Ph.D. in IS (Indiana University)
• MBA in IS (Texas Tech University)
• Industry experience in networking, programming,
  project management.

10
Introduction to Information Security Management

• Do not figure on opponents not attacking
• worry about your own lack of preparation.
• BOOK OF THE FIVE RINGS

11
Information Security Management

• You can have all the protection mechanisms in
  place and still have security problems

12
Information Security Management
http//www.twincities.com/business/ci_24887125/tar
get-breach-likely-an-inside-job-data-security
13
Information Security Management(From PWC Global
State of Information Security 2014)
14
Information Security Management

• The goal of this course is to take a step back
  and examine how security functions as a whole
  within the organization.
• Challenge
• Everything cannot be categorized as right or
  wrong
• What works for one company may fail in another

15
Certified Information Systems Security
Professional

• Five years of experience in information security
• There are 250 multiple-choice questions
• Exam duration six hours

16
Associate of (ISC)2 Certification

• No experience required
• Shows that you passed the exam, and that you are
  serious about a career in Information Security
• Subscribe to the (ISC)² Code of Ethics

17
Other Certifications

• Systems Security Certified Practitioner
• Only one year of experience required
• Test is 90 minutes long, 50-70 questions
• Certified Ethical Hacker

18
Early forms of Information Security
Figure 1-1 The Enigma Source Courtesy of
National Security Agency
19
The 1990s

• Networks of computers became more common so too
  did the need to interconnect networks
• Internet became first manifestation of a global
  network of networks
• In early Internet deployments, security was
  treated as a low priority

20
2000 to Present

• The Internet brings millions of computer networks
  into communication with each othermany of them
  unsecured
• Ability to secure a computers data influenced by
  the security of every computer to which it is
  connected
• Growing threat of cyber attacks has increased the
  need for improved security

21
Introduction

• The concept of computer security has become
  synonymous with the concept of information
  security
• Information security is no longer the sole
  responsibility of a discrete group of people in
  the company

22
Information Security Decision Makers

• 1) Information security mgr and professionals
• (InfoSec Community)
• 2) Information technology mgr and professionals
• (Information Technology Community)
• 3) Non-technical business mgr and professionals
• (General Business Community)

23
What Is Security?

• How do you define security?
• Specialized areas of security
• Physical
• Operations
• Communications
• Network

Each of these areas contribute to the information
security program as a whole
24
What Is Information Security?

• What is Information Security?
• How do we achieve Information Security?
• Policy
• Technology
• Training and Awareness Programs

Role of information security is to protect an
organizations information assets
25
Components of an Information System

• Information system (IS) is entire set of
  components necessary to use information as a
  resource in the organization
• Software
• Hardware
• Data
• People
• Procedures
• Networks

26
Key Information Security Concepts

• Protection Profile or Security Posture
• Risk
• Subjects and Objects
• Threat
• Threat Agent
• Vulnerability

• Access
• Asset
• Attack
• Control, Safeguard, or Countermeasure
• Exploit
• Exposure
• Loss

27
Figure 1-1 Components of Information security
http//www.cnss.gov/policies.html
Source Course Technology/Cengage Learning
28
CNSS Security Model (contd.)

• C.I.A. triangle
• Confidentiality, integrity, and availability
• Has expanded into a more comprehensive list of
  critical characteristics of information
• NSTISSC (CNSS) Security Model
• Provides a more detailed perspective on security
• Covers the three dimensions of information
  security
• Primary purpose identify gaps in the coverage
  of an information security program

29
CNSS Security Model (contd.)

• NSTISSC Security Model (contd.)
• Must address all 27 cells when designing/reviewing
  a program

Main Purpose identify gaps in an information
security program
30
How to measure the value of information - CIA
Triangle
The value of information comes from the
characteristics it possesses
Expanded to include
Identification Authentication Authorization Priva
cy Accountability
31
Confidentiality

• The characteristic of information whereby only
  those with sufficient privileges may access
  certain information
• Measures used to protect confidentiality
• Information classification
• Secure document storage
• Application of general security policies
• Education of information custodians and end users

32
Integrity

• The quality or state of being whole, complete,
  and uncorrupted
• Threats to information integrity
• Corruption
• Damage
• Destruction
• Other disruption of its authentic state

33
Availability

• The characteristic of information that enables
  user access to information in a required format,
  without interference or obstruction
• Availability does not imply that the information
  is accessible to any user (Implies availability
  to authorized users)

34
Identification and Authentication

• Identification
• An information system possesses the
  characteristic of identification when it is able
  to recognize individual users
• Identification and authentication are essential
  to establishing the level of access or
  authorization that an individual is granted
• Authentication
• Occurs when a control proves that a user
  possesses the identity that he or she claims

35
Authorization

• Assures that the user has been specifically and
  explicitly authorized by the proper authority to
  access, update, or delete the contents of an
  information asset
• Authorization occurs after authentication

36
Privacy

• Information collected, used, and stored by an
  organization is to be used only for the purposes
  stated to the data owner at the time it was
  collected
• Privacy as a characteristic of information does
  not signify freedom from observation
• Means that information will be used only in ways
  known to the person providing it

37
Accountability

• Exists when a control provides assurance that
  every activity undertaken can be attributed to a
  named person or automated process

38
Balancing Information Security and Access

• Should everyone have an access button?
• Should information be kept in a vault?

39
Balancing Information Security and Access

• Impossible to obtain perfect securityit is a
  process, not an absolute
• Security should be considered balance between
  protection and availability

40
Information Security Is it an Art or a Science?

• Implementation of information security often
  described as combination of art and science
• Security artesan idea

41
Security as Art

• No hard and fast rules nor many universally
  accepted complete solutions
• No manual for implementing security through
  entire system

42
Security as Science

• Dealing with technology designed to operate at
  high levels of performance
• Specific conditions cause virtually all actions
  that occur in computer systems
• Nearly every fault, security hole, and systems
  malfunction are a result of interaction of
  specific hardware and software
• If developers had sufficient time, they could
  resolve and eliminate faults

43
Principles of Information Security Management

• Include the following characteristics that will
  be the focus of the current course (six Ps)
• Planning
• Policy
• Programs
• Protection
• People
• Project Management

http//csrc.nist.gov/publications/PubsTC.html
44
Planning

• Planning as part of InfoSec management
• An extension of the basic planning model
  discussed earlier in this chapter
• Included in the InfoSec planning model
• Activities necessary to support the design,
  creation, and implementation of information
  security strategies

45
Planning (contd.)

• Types of InfoSec plans
• Incident response planning
• Business continuity planning
• Disaster recovery planning
• Policy planning
• Personnel planning
• Technology rollout planning
• Risk management planning
• Security program planning
• includes education, training and awareness

46
Policy

• The set of organizational guidelines that
  dictates certain behavior within the organization
• Three general categories of policy
• Enterprise information security policy (EISP)
• Issue-specific security policy (ISSP)
• System-specific policies (SysSPs)

UNCW Policies
47
Programs

• InfoSec operations that are specifically managed
  as separate entities
• Example a security education training and
  awareness (SETA) program
• Other types of programs
• Physical security program
• complete with fire, physical access, gates,
  guards, etc.

48
Protection

• Executed through risk management activities
• Includes
• Risk assessment and control
• Protection mechanisms
• Technologies
• Tools
• Each of these mechanisms represents some aspect
  of the management of specific controls in the
  overall information security plan

49
People

• Managers must recognize the crucial role that
  people play in the information security program
• This area of InfoSec includes security personnel
  and the security of personnel, as well as aspects
  of a SETA program
• The most critical link in the information
  security program

50
Project Management

• Identifying and controlling the resources applied
  to the project
• Measuring progress
• Adjusting the process as progress is made

51
Summary

• What is security?
• Principles of information security management
• Planning
• Policy
• Programs
• Protection
• People
• Project management

52
Next Class

• Read Chapter 2 Planning for Security
• Signup for Entropy
• Lecture Slides and additional readings will be
  posted in the calendar
• Teams and Topic Selections
• I will cover discussion of cases and current
  events next week but read them before class!