IS3350 Security Issues in Legal Context

© ITT Educational Services, Inc. All rights reserved.

IS3350 Security Issues in Legal Context

Unit 1

Information Systems Security Overview

© ITT Educational Services, Inc. All rights reserved.IS3350 Security Issues in Legal Context

Learning Objective

Recognize the legal aspects of the information security triad: Availability Integrity Confidentiality


Key ConceptsAvailability, Integrity, and Confidentiality

(AIC Triad)Basic information system security conceptsRisk analysis and mitigationMechanisms for organizational information

securityData classifications requiring specialized

legal consideration


EXPLORE: CONCEPTS


Confidentiality

Integrity Availability

Information Security

CIA Triad


Shoulder Surfing Social Engineering Spear Phishing Malware Spyware Logic Bomb Back Door Denial of Service

Information Security Common Concerns


General Military Classification

General Corporate Classification

Top SecretCorporate

Confidential

Secret Client Confidential

Confidential Proprietary

RestrictedPublic

Unclassified

Data Classification


Legal Mechanisms to Ensure Information Security

Laws• Gramm-Leach-Bliley Act, HIPPA,

Sarbanes-Oxley (SOX), and others Information Regulations• Financial, credit card, health, etc.

Agencies• FTC, Banks, DHHS, SEC, DOE, etc.


Vulnerability ~ asset weaknesses

Mitigation ~ safeguard assets

Threat Agent ~ hacker or malware

Exploits ~ threats carried out

Risks ~ minimized by asset owner

Risk Management Concepts


EXPLORE: PROCESS


Owner

Safeguard

Vulnerability

Risk

Asset

Threat Agent

Threat

Risk Management Process


EXPLORE: ROLES


Senior Management

Information Technology Department

Legal Department

Chief Information Security Officer

Roles in Risk Management


EXPLORE: CONTEXT


Information Security in Different Contexts

Government Organizations

Corporations

High Interest in Confidentiality

High Interest in Availability

Mandatory Access

Lattice-Based Models

Discretionary Access

Role-Based Models


Discretionary Access Control (DAC):

discretion of the owner

Mandatory Access Control (MAC):

security labels & classifications

Role-Based Access Control (RBAC):

job function or role

Access Control Models


EXPLORE: RATIONALE


Cyberspace theft

Internet extortion

Online pedophilia

Jurisdiction issues

Electronic signature issues

Law and Information Security


Summary

Availability, Integrity, and Confidentiality (AIC Triad)

Basic information system security conceptsRisk analysis and mitigationMechanisms for organizational information

securityData classifications requiring specialized

legal consideration

IS3350 Security Issues in Legal Context

Documents

Transcript of IS3350 Security Issues in Legal Context