Information Security 1 Information Security: Security Tools Jeffy Mwakalinga.
Information Security
description
Transcript of Information Security
EDU 5815
1
Information Security
EDU 5815
2
IT Security Terms
EDU 5815
3
Backup An extra copy of the data and/or programs, kept in a secure location(s).
Decryption Transformation of scrambled code into readable data after transmission.
Encryption Transformation of data into scrambled code after transmission.Exposure The harm, loss, or damage that can result if something has gone wrong
in an information system.Fault tolerance The ability of an information system to continue to operate (usually for a
limited time and/or at a reduced level) when failure occurs.Information system controls
The procedures, devices, or software that attempt to ensure that the system performs as planned.
Integrity (of data) A guarantee of the accuracy, completeness, and reliability of data. System integrity is provided by the integrity of its components and their integrations.
Risk The likelihood that a threat will materialized. Threats (or hazards)
The various dangers to which a system may be exposed.
Vulnerability Given that a threat exists, the susceptibility of the system to harm caused by the threat.
Malware General term for software that enables malicious acts against a computing system.
EDU 5815
4
Organizational needs for security and control•Importance of keeping all of the
resources, virtual as well as physical, secure from both inside and outside threats
•Two critical issues must be addressed:▫Security vs. individual rights▫Security vs. availability
EDU 5815
5
Security vs. individual rights•Implement adequate security and control
measures that do not infringe on the individual rights guaranteed by the constitution
EDU 5815
6
Security vs. availability•Prominent in the medical area•Concerns over the privacy of the
individuals’ records are receiving attention
EDU 5815
7
Objective of Information Security•Confidentiality•Availability•Integrity
EDU 5815
8
Confidentiality •The organization seek to protect its data
and information from disclosure to unauthorized persons.
•Executive information systems, human resources information systems, and such transaction processing systems as payroll, accounts receivable, purchasing, and accounts payable are especially critical in this regard.
EDU 5815
9
Availability •The purpose of the organization’s
information infrastructure is to make its data and information available to those who are authorized to used it.
•This objective is especially important to information-oriented systems such as human resources information systems
EDU 5815
10
Integrity •All the information systems should
provide an accurate representation of the physical systems that they represent.
EDU 5815
11
System Vulnerability A universal vulnerability is a state in a computing
system which either: allows an attacker to execute commands as another user; allows an attacker to access data that is contrary to the access restrictions for that data; allows an attacker to pose as another entity; or allows an attacker to conduct a denial of service.
An exposure is a state in a computing system (or set of systems) which is not a universal vulnerability, but either: allows an attacker to conduct information gathering activities; allows an attacker to hide activities; includes a capability that behaves as expected, but can be easily compromised; is a primary point of entry that an attacker may attempt to use to gain access to the system or data; and is considered a problem according to some reasonable security policy.
EDU 5815
12
System Vulnerability Continued
• These threats can be classified as:▫ Unintentional
Human errors Environmental hazards Computer system failures
▫ Intentional Theft of data Inappropriate use of data Theft of mainframe computer time Theft of equipment and/or programs
The vulnerability of information systems is increasing as we move to a world of networked and especially wireless computing. Theoretically, there are hundreds of points in a corporate information system that can be subject to some threats.
EDU 5815
13
System Vulnerability Continued
▫ Intentional continued Deliberate manipulation in handling Entering data Processing data Transferring data Programming data Labor strikes Riots Sabotage Malicious damage to computer resources Destruction from viruses and similar attacks Miscellaneous computer abuses Internet fraud. Terrorists’ attack
EDU 5815
14
Threats •An information security threat is a person,
organization, mechanism, or event that has potential to inflict harm on the organization’s information resources.
•Threats can be internal as well as external, and they can be accidental as well as intentional.
EDU 5815
15
Type of threats•A virus is one example of a type of
software that bears the name malicious software
•Malicious software or malware consists of complete programs or segments of code that can invade a system and perform functions not intended by the system owners
•In addition to viruses, there are worms, Trojan horses, adware, and spyware
EDU 5815
16
Type of threats•A virus is a computer program that can
replicate itself without being observable and embed copies of itself in other programs and boot sectors
•A worm cannot replicate itself within a system, but it can transmit its copies by means of email
EDU 5815
17
Type of threats•A Trojan horse can neither replicate nor
distribute itself; users distributes it as utility.
•When the utility is used, it produced unwanted changes in the system’s functionality.
EDU 5815
18
Type of threats•Adware generates intrusive advertising
messages•Spyware gathers data from the user’s
machine
EDU 5815
19
EDU 5815
20
Risks•Information security risk is a potential
undesirable outcome of a breach of information security by an information security threat
•All risks represent unauthorized acts
EDU 5815
21
Four type of risks1. Unauthorized Disclosure and Theft
▫ When the database and software library are made available to persons not entitled to have access
▫ The result can be the loss of information or money
2. Unauthorized Use– When persons who are not ordinarily entitled to
use the organization’s resources are able to do so– hacker
EDU 5815
22
Four type of risks3. Unauthorized Destruction and Denial of
Service– Individuals can damage or destroy hardware or
software, causing the organization’s computer operation to shut down
4. Unauthorized Modification– Changes been made to the data, information and
software. – Changes go unnoticed and cause the users of the
system outputs to make the wrong decisions
EDU 5815
23
Challenges and Ethics of IT•Application of IT
▫Customer relationship management▫Human resources management▫Business intelligence systems
•Potential Harm▫Infringements on privacy▫Inaccurate information▫Collusion
EDU 5815
24
Challenges and Ethics of IT•Possible Responses
EDU 5815
25
Protecting Information Resources
• Aligned. The program must be aligned with organizational goals. • Enterprisewide. Everyone in the organization must be included.• Continuous. The program must be operational all the time. • Proactive. Use innovative, preventive, and protective measures. • Validated. The program must be tested to ensure it works. • Formal. It must include authority, responsibility & accountability.
Information security problems are increasing rapidly, causing damage to many organizations. Protection is expensive and complex. Therefore, companies must not only use controls to prevent and detect security problems, they must do so in an organized manner. An approach similar to TQM (total quality management) would have the following characteristics:
EDU 5815
26
Difficulties – Protecting (discussion)
EDU 5815
27
Defense Strategy - Protecting
• The major objectives of a defense strategy are: 1. Prevention and deterrence.2. Detection.3. Limitation of damage.4. Recovery.5. Correction6. Awareness and compliance
EDU 5815
28
Defense Strategy - Controls
Any defense strategy involves the use of several controls. These controls are divided into two categories general controls that protect the system regardless of the specific application and application controls that safeguard specific applications.
General Application
EDU 5815
29
Defense Strategy – Internet Security
Security Layers
The major objective of border security is access control. Then authentication or proof of identity and finally authorization which determine the action or activities a user is allowed to perform.
EDU 5815
30
Ethical Responsibilities•What uses of IT might be considered
improper or harmful to other individuals or society?
•What is the proper use of the Internet or organization's IT resources?
•How can you protect yourself from computer crime?