lecture 1 infosec

• Information Technology (IT) facilitates the storage and transfer of valuable information within organizations.​
• INFORMATION SECURITY:​

  • protects information assets ensuring confidentiality, integrity, and availability.​
  • includes the technology that houses and transfers that information through a variety of protection mechanisms such as policy, training and awareness programs, and technology

  
  

  
  

  ​
• Confidentiality:​

  • protects data from unauthorized access or disclosure.​
  • Limits access of information to people who need it and people who don't.​

  ​
• The CIA Triad and the CNSS Model:​

  • The NSTISSI (or CNSS) Security Model, also known as the McCumber Cube, offers a detailed perspective on security.​

  ​
• Integrity:​

  • Ensures data remains whole, complete, and uncorrupted.​
  • Corruption occurs while information is being entered, stored or transmitted. ​

  ​
• Availability:​

  • Ensures data is accessible and correctly formatted for use without blockage
  • Authorized users should have access to information when needed, without interference.​

  ​
• INFORMATION AGGRESION:​

  • Organizations collect, exchange, and sell personal information.​
  • combines data from personal information from various sources
• IDENTIFICATION:​

  • Users provide personal information to access resources in the system.​
• PRIVACY:​

  • Protects individuals' or groups' information from unauthorized access, ensuring confidentiality.​

  ​

  ​
• AUTHORIZATION::​

  • Ensures all actions of a system, authorized and unauthorized can be attributed to an authenticated identity, know an auditability.​

  ​
• ACCOUNTABILITY:​

  • Matches authenticated entities to information assets and access levels.​
  • Defines specific permissions granted by proper authority, such as access, modification, or deletion of information assets.​

  ​
• AUTHENTICATION:​

  • Validates and verifies an entity's claimed identity.​
  • Users typically provide a PIN, password, or passphrase to authenticate their identity.​

  ​
• Compromises to  Intellectual Property (IP):​

  • Software Piracy, copyright infringement/ protection and user registration​

  ​
• Human Error or Failure:​

  • Accidents, employee mistakes​

  ​
• Technical Software Failures:​

  • Bugs, code problems, unknown loopholes​

  ​
• Deviations in Quality of Service:​

  • Internet service provider (ISP) issues, power irregularities, or WANS service problems, communications and other service provider issues.​

  ​
• Sabotage or Vandalism: ​

  • Destruction of systems or information ​
• Forces of Nature:​

  • Natural disasters 
  • Insurance can mitigate forces of nature ​

  ​
• Software Attacks:​

  • Malware (viruses, worms, Trojan horses), backdoors, denial-of-service (DoS) attacks, e-mail attacks, and interception attacks are common.​

  ​
• Technological Obsolescence:​

  • Antiquated or outdated technologies, there is a higher risk in losing data from attacks​

  ​
• Technical Hardware Failures:​

  • Equipment failure​
  • Measured in Mean Time Between Failure (MTBF) and Mean Time to Failure (MTTF).​
  • MTBF accounts for diagnosis and repair time (MTTD and MTTR).​

  ​
• Deadly Sins of Software Security:​

  • Web Application Sins: SQL injection, XSS, predictable cookies.​
  • Implementation Sins: Buffer overflow, format string problems, poor error handling.​
  • Cryptographic Sins: Weak password systems, improper use of encryption.​
  • Networking Sins: Failure to protect network traffic, improper use of PKI​

  ​
• Espionage and Trespass:​

  • Unauthorized access and/ or data collection​
  • Password attacks are common, password cracking could be calculated by using, brute force attacks, dictionary password attack, rainbow tables, social engineering password attacks.​

  ​
• Theft:​

  • Illegal confiscation of equipment or information​

  ​
• Information Extortion:​

  • Blackmail, information disclosure, theft of credit card information​

  ​

  ​
• Planning:​Process of Developing, creating, implementing strategies to achieve objectives.​
• Management Characteristics:​

  • Traditional management theory: Planning, organizing, staffing, directing, and controlling (POSDC).​
• Policy:​

  • Guidelines dictating behavior within the organization.​
  • Three categories: Enterprise Information Security Policy (EISP), Issue-Specific Security Policy (ISSP), and System-Specific Policies (SysSPs).​

  ​
• Protection:​

  • Executed through risk management activities, including assessment, control, and implementation of protection mechanisms.​

  ​
• Programs:​

  • Managed InfoSec operations, such as security education, training, and awareness programs.​
  • May include physical security programs eg. Gates, guards.​

  ​
• People:​

  • Critical aspect of InfoSec.​
  • Involves security personnel, training programs, and ensuring security of personnel.​

  ​
• Project Management:​

  • Information security is both a process and a series of projects.​
  • Each element of InfoSec program must be managed as a project.​
  • Continuous series of projects alongside ongoing managed processes​

  ​
• Organizing: Structuring resources to support objectives.​
• Leading: Supervising employee behavior, performance, and task completion.​
• Controlling: Ensuring progress, resolving impediments, and managing resources effectively.​​
• information security safeguards information