Topic 5b- Chapter 4- Information Security and Controls

• Security


  Protection of information resources from threats
• Information security


  Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction
• Threat


  Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or society through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service

  
• Exposure


  The state of being unprotected and vulnerable to damage or harm
• Vulnerability


  A weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source
• Five key factors contributing to vulnerability

  • Today's interconnected, interdependent, wirelessly networked business environment
  • Smaller, faster, inexpensive computers and storage devices
  • Decreasing skills necessary to be a computer hacker
  • International organized crime taking over cybercrime
  • Lack of management support
• Human errors


  Unintentional threats to information systems caused by mistakes made by people
• Social engineering


  An attack in which the perpetrator uses social skills to trick or manipulate legitimate employees into providing confidential company information such as passwords
• Deliberate threats to information systems

  • Espionage or trespassing
  • Information extortion
  • Sabotage or vandalism
  • Theft of equipment or information
  • Identity theft
  • Compromises to intellectual property
  • Software attacks
  • Alien software
  • Supervisory control and data acquisition (SCADA) attacks
  • Cyberterrorism and cyberwarfare
• Virus


  A type of remote software attack that requires user action
• Worm


  A type of remote software attack that requires user action
• Phishing attack


  A type of remote software attack that requires user action
• Spear phishing attack


  A type of remote software attack that requires user action
• Whaling attack


  A type of remote software attack that requires user action
• Smishing attack


  A type of remote software attack that requires user action
• Vishing attack


  A type of remote software attack that requires user action
• Denial of service attack


  A type of remote software attack that needs no user action
• Distributed denial of service attack

  A type of remote software attack that needs no user action
• Trojan horse


  A type of software attack by a programmer developing a system
• Back door


  A type of software attack by a programmer developing a system
• Logic bomb


  A type of software attack by a programmer developing a system
• Adware


  A type of alien software
• Spyware


  A type of alien software, including keyloggers
• Spamware


  A type of alien software
• Cookies


  A type of alien software, including tracking cookies
• Risk


  The potential for loss, damage, or destruction of an asset as a result of a threat exploiting a vulnerability
• Risk analysis


  The process of identifying, quantifying, and prioritizing the risks to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system
• Risk mitigation strategies


  • Risk acceptance
  • Risk transference
  • Risk limitation
• Risk acceptance


  A risk mitigation strategy where the organization acknowledges the existence of a particular risk and makes an informed decision to accept it without engaging in special efforts to control it
• Risk transference


  A risk mitigation strategy where the organization shifts the burden of risk to another party, such as purchasing insurance
• Risk limitation


  A risk mitigation strategy where the organization applies controls to minimize the adverse impact of threats and vulnerabilities, i.e. reducing the risk
• Information systems auditing


  The process of collecting and evaluating evidence to determine whether an information system safeguards assets, maintains data integrity, and allows organizational goals to be achieved effectively and efficiently
• Types of auditors and audits

  • Internal auditors
  • External auditors
  • Operational audits
  • Compliance audits
  • Financial audits
  • Information systems audits
• Physical controls


  Security measures that are designed to deny access to unauthorized personnel from physically accessing a company's facilities and information resources
• Examples of physical controls

  • Walls
  • Doors
  • Fencing
  • Gates
  • Locks
  • Badges
  • Guards
  • Alarm systems
• Access controls


  Security measures that are designed to allow only authorized personnel to access information resources
• Communication controls


  Security measures that are designed to protect the transmission of information across computer networks
• Application controls


  Security measures that are designed to ensure the completeness, accuracy, and validity of data input, processing, and output within specific applications
• Business continuity planning


  The process of developing and documenting arrangements and procedures that enable an organization to respond to an event that causes an abnormal and undesirable situation, in order to continue minimum business operations and minimize losses
• Disaster recovery plan


  A plan for restoring an organization's critical information technology infrastructure and operations after a disaster