SlideShare ist ein Scribd-Unternehmen logo
1 von 15
Six Irrefutable Laws
of Information Security
IT Risk and Security
Opposing Forces




                                                                   Locked Down
                                                                     Information assets
                                                               should be fully protected

                      Open Access
                      Reduces cost and enables
                      use of data and systems




2   Copyright © 2012 Intel Corporation. All rights reserved.
IT Risk and Security
    A Balancing Act



       Open Access
       Reduces cost and                             How do we balance:
      enables use of data                           • Access to information?
         and systems
                                                    • Protection of information?
                                                    • Legal compliance?
                                                    • Privacy of data?             Locked Down
                                                                                   Information assets
                                                    • Cost of controls?
                                                                                     should be fully
                                                                                        protected




3   Copyright © 2012 Intel Corporation. All rights reserved.
You can achieve balance in your
                                                   security controls by understanding the
                Six Irrefutable Laws of Information Security1
              and making choices about your design accordingly.




1   Phil Venables 2008, adapted from Scott Culp 2000, Pete Lindstrom 2008, and other sources
Law 1                    Information wants to be free.
                        People have a natural tendency to share information
                        with each other—through talk, posts, and email




Sharing information creates potential for leakage. People
may release information that shouldn’t be set free. But sharing also
increases innovation. We need to make it safe to collaborate.

                                * Other names and brands may be claimed as the property of others.

5   Copyright © 2012 Intel Corporation. All rights reserved.
Law 2                    Code wants to be wrong.
                         Because people write code, it will never be
                         100 percent error-free.

                                                               If intruders are smart
                                                               and persistent, they
                                                               will find a way into
                                                               the software.
                                                               There is no simple
                                                               solution. We need to
                                                               stay vigilant and
                                                               ready to adjust
                                                               security controls.




6   Copyright © 2012 Intel Corporation. All rights reserved.
Law 3                    Services want to be on.
                        Services need to be left on so that processes
                        and updates can run in the background.




                                                               But when services are left on, security
                                                               risk rises. People add to the risk by
                                                               installing services like application
                                                               updates. Services that “are always on”
                                                               can potentially open a straight line
                                                               into the system for the intruder.




7   Copyright © 2012 Intel Corporation. All rights reserved.
Law 4                    Users want to click.
                      When people are connected to the Internet,
                      they sometimes click on things without thinking.

                                                  Curiosity can overcome judgment when people
                                                  see interesting things on the Internet. Clicking
                                                  on things make systems and people vulnerable.




8   Copyright © 2012 Intel Corporation. All rights reserved.
Law 5                    Even a security feature can be used for harm.
                        The risks of code errors and services left
                        on, leaves “holes” in security controls.




    Security controls are designed to create
    safety. But, like other software, security
    controls are created with code, and can
    be manipulated and coopted by hackers
    with malicious intent.




9   Copyright © 2012 Intel Corporation. All rights reserved.
Law 6                   The efficacy of a control deteriorates with time.
                       We tend to set and forget about security
                       controls, allowing them to lose effectiveness over
                       time.




                                                              Forgetting about security controls
                                                              leaves systems open to risk. Hackers
                                                              move fast; we need to move faster—
                                                              and maintain an ongoing assessment
                                                              of controls.




10 Copyright © 2012 Intel Corporation. All rights reserved.
You may think you know a threat when it approaches…




11 Copyright © 2012 Intel Corporation. All rights reserved.
… but don’t assume you recognize the true risk.




12 Copyright © 2012 Intel Corporation. All rights reserved.
Risk surrounds and envelops us.


                                       Without understanding it,


                                                  we risk everything,


                                      without capitalizing on it,


                                                        we gain nothing.4

                                            4 Glynis Breakwell – The Psychology of Risk
13 Copyright © 2012 Intel Corporation. All rights reserved.
The most effective information security controls help you
  understand, manage, and balance the inevitable risks.




          If you want to know more…
          "Can Information Security Survive?" webinar
          Malcolm Harkins, Vice President and Chief Information
          Security Officer at Intel, talks about balancing business
          needs and growth with risk mitigation.




14 Copyright © 2012 Intel Corporation. All rights reserved.
Learn more about Intel IT’s information
                               security initiatives at: Intel.com/IT




15 Copyright © 2012 Intel Corporation. All rights reserved.

Weitere ähnliche Inhalte

Was ist angesagt?

Rethink cloud security to get ahead of the risk curve by kurt johnson, vice p...
Rethink cloud security to get ahead of the risk curve by kurt johnson, vice p...Rethink cloud security to get ahead of the risk curve by kurt johnson, vice p...
Rethink cloud security to get ahead of the risk curve by kurt johnson, vice p...
Khazret Sapenov
 
Best Practice For Public Sector Information Security And Compliance
Best  Practice For  Public  Sector    Information  Security And  ComplianceBest  Practice For  Public  Sector    Information  Security And  Compliance
Best Practice For Public Sector Information Security And Compliance
Oracle
 
Edith Turuka: Cyber-Security, An Eye Opener to the Society
Edith Turuka: Cyber-Security, An Eye Opener to the SocietyEdith Turuka: Cyber-Security, An Eye Opener to the Society
Edith Turuka: Cyber-Security, An Eye Opener to the Society
Hamisi Kibonde
 
Addressing security and privacy in io t ecosystem v0.4
Addressing security and privacy in io t ecosystem v0.4Addressing security and privacy in io t ecosystem v0.4
Addressing security and privacy in io t ecosystem v0.4
Somasundaram Jambunathan
 
Bright talk intrusion prevention are we joking - henshaw july 2010 a
Bright talk   intrusion prevention are we joking - henshaw july 2010 aBright talk   intrusion prevention are we joking - henshaw july 2010 a
Bright talk intrusion prevention are we joking - henshaw july 2010 a
Mark Henshaw
 
2 21677 splunk_big_data_futureofsecurity
2 21677 splunk_big_data_futureofsecurity2 21677 splunk_big_data_futureofsecurity
2 21677 splunk_big_data_futureofsecurity
Svetlana Belyaeva
 

Was ist angesagt? (19)

Rethink cloud security to get ahead of the risk curve by kurt johnson, vice p...
Rethink cloud security to get ahead of the risk curve by kurt johnson, vice p...Rethink cloud security to get ahead of the risk curve by kurt johnson, vice p...
Rethink cloud security to get ahead of the risk curve by kurt johnson, vice p...
 
Information Security For Small Business
Information Security For Small BusinessInformation Security For Small Business
Information Security For Small Business
 
The importance of information security
The importance of information securityThe importance of information security
The importance of information security
 
Best Practice For Public Sector Information Security And Compliance
Best  Practice For  Public  Sector    Information  Security And  ComplianceBest  Practice For  Public  Sector    Information  Security And  Compliance
Best Practice For Public Sector Information Security And Compliance
 
presCyberNISC2015
presCyberNISC2015presCyberNISC2015
presCyberNISC2015
 
Edith Turuka: Cyber-Security, An Eye Opener to the Society
Edith Turuka: Cyber-Security, An Eye Opener to the SocietyEdith Turuka: Cyber-Security, An Eye Opener to the Society
Edith Turuka: Cyber-Security, An Eye Opener to the Society
 
FROM STRATEGY TO ACTION - Vasil Tsvimitidze
FROM STRATEGY TO ACTION - Vasil Tsvimitidze FROM STRATEGY TO ACTION - Vasil Tsvimitidze
FROM STRATEGY TO ACTION - Vasil Tsvimitidze
 
Security Testing for Testing Professionals
Security Testing for Testing ProfessionalsSecurity Testing for Testing Professionals
Security Testing for Testing Professionals
 
Information Security for Small Business
Information Security for Small BusinessInformation Security for Small Business
Information Security for Small Business
 
Addressing security and privacy in io t ecosystem v0.4
Addressing security and privacy in io t ecosystem v0.4Addressing security and privacy in io t ecosystem v0.4
Addressing security and privacy in io t ecosystem v0.4
 
Bright talk intrusion prevention are we joking - henshaw july 2010 a
Bright talk   intrusion prevention are we joking - henshaw july 2010 aBright talk   intrusion prevention are we joking - henshaw july 2010 a
Bright talk intrusion prevention are we joking - henshaw july 2010 a
 
Julius Clark is Making Criminal Hackers Miserable
Julius Clark is Making Criminal Hackers MiserableJulius Clark is Making Criminal Hackers Miserable
Julius Clark is Making Criminal Hackers Miserable
 
Art Hathaway - Artificial Intelligence - Real Threat Prevention
Art Hathaway - Artificial Intelligence - Real Threat PreventionArt Hathaway - Artificial Intelligence - Real Threat Prevention
Art Hathaway - Artificial Intelligence - Real Threat Prevention
 
Cyber Threats & Cybersecurity - Are You Ready? - Jared Carstensen
Cyber Threats & Cybersecurity - Are You Ready? - Jared CarstensenCyber Threats & Cybersecurity - Are You Ready? - Jared Carstensen
Cyber Threats & Cybersecurity - Are You Ready? - Jared Carstensen
 
Security Testing for Testing Professionals
Security Testing for Testing ProfessionalsSecurity Testing for Testing Professionals
Security Testing for Testing Professionals
 
NUS-ISS Learning Day 2017 - Security Dynamics - Moving IoT and Beyond
NUS-ISS Learning Day 2017 - Security Dynamics - Moving IoT and BeyondNUS-ISS Learning Day 2017 - Security Dynamics - Moving IoT and Beyond
NUS-ISS Learning Day 2017 - Security Dynamics - Moving IoT and Beyond
 
OS17 Brochure
OS17 BrochureOS17 Brochure
OS17 Brochure
 
Challenges2013
Challenges2013Challenges2013
Challenges2013
 
2 21677 splunk_big_data_futureofsecurity
2 21677 splunk_big_data_futureofsecurity2 21677 splunk_big_data_futureofsecurity
2 21677 splunk_big_data_futureofsecurity
 

Andere mochten auch

Information security management system
Information security management systemInformation security management system
Information security management system
Arani Srinivasan
 

Andere mochten auch (17)

7 Things Every Ceo Should Know About Information Security
7 Things Every Ceo Should Know About Information Security7 Things Every Ceo Should Know About Information Security
7 Things Every Ceo Should Know About Information Security
 
Risk Factory Information Security Coordination Challenges & Best Practice
Risk Factory Information Security Coordination Challenges & Best PracticeRisk Factory Information Security Coordination Challenges & Best Practice
Risk Factory Information Security Coordination Challenges & Best Practice
 
Tci reference architecture_v2.0
Tci reference architecture_v2.0Tci reference architecture_v2.0
Tci reference architecture_v2.0
 
Development and implementation of metrics for information security risk asses...
Development and implementation of metrics for information security risk asses...Development and implementation of metrics for information security risk asses...
Development and implementation of metrics for information security risk asses...
 
Security Governance Primer - Eric Vanderburg - JURINNOV
Security Governance Primer - Eric Vanderburg - JURINNOVSecurity Governance Primer - Eric Vanderburg - JURINNOV
Security Governance Primer - Eric Vanderburg - JURINNOV
 
Information & Cyber Security Risk
Information & Cyber Security RiskInformation & Cyber Security Risk
Information & Cyber Security Risk
 
Dealing with Information Security, Risk Management & Cyber Resilience
Dealing with Information Security, Risk Management & Cyber ResilienceDealing with Information Security, Risk Management & Cyber Resilience
Dealing with Information Security, Risk Management & Cyber Resilience
 
Information Security Strategic Management
Information Security Strategic ManagementInformation Security Strategic Management
Information Security Strategic Management
 
Information Security Benchmarking 2015
Information Security Benchmarking 2015Information Security Benchmarking 2015
Information Security Benchmarking 2015
 
Information security management system
Information security management systemInformation security management system
Information security management system
 
SYMANTEC ENDPOINT PROTECTION Advanced Monitoring and Reporting
SYMANTEC ENDPOINT PROTECTION Advanced Monitoring and ReportingSYMANTEC ENDPOINT PROTECTION Advanced Monitoring and Reporting
SYMANTEC ENDPOINT PROTECTION Advanced Monitoring and Reporting
 
Enterprise Security Architecture for Cyber Security
Enterprise Security Architecture for Cyber SecurityEnterprise Security Architecture for Cyber Security
Enterprise Security Architecture for Cyber Security
 
NormShield Cyber Threat & Vulnerability Orchestration Overview
NormShield Cyber Threat & Vulnerability Orchestration OverviewNormShield Cyber Threat & Vulnerability Orchestration Overview
NormShield Cyber Threat & Vulnerability Orchestration Overview
 
Enterprise Security Architecture
Enterprise Security ArchitectureEnterprise Security Architecture
Enterprise Security Architecture
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security Roadmap
 
Measuring Success - Security KPIs
Measuring Success - Security KPIsMeasuring Success - Security KPIs
Measuring Success - Security KPIs
 
INFORMATION SECURITY
INFORMATION SECURITYINFORMATION SECURITY
INFORMATION SECURITY
 

Ähnlich wie Six Irrefutable Laws of Information Security

Top Cyber Security Interview Questions and Answers 2022.pdf
Top Cyber Security Interview Questions and Answers 2022.pdfTop Cyber Security Interview Questions and Answers 2022.pdf
Top Cyber Security Interview Questions and Answers 2022.pdf
Careerera
 
vip_day_2._1130_cloud
vip_day_2._1130_cloudvip_day_2._1130_cloud
vip_day_2._1130_cloud
Nicholas Chia
 
Pci compliance training agents
Pci compliance training  agentsPci compliance training  agents
Pci compliance training agents
ocinc
 

Ähnlich wie Six Irrefutable Laws of Information Security (20)

Critical Infrastructure Security by Subodh Belgi
Critical Infrastructure Security by Subodh BelgiCritical Infrastructure Security by Subodh Belgi
Critical Infrastructure Security by Subodh Belgi
 
Data Security Breach: The Sony & Staples Story
Data Security Breach: The Sony & Staples StoryData Security Breach: The Sony & Staples Story
Data Security Breach: The Sony & Staples Story
 
Top Security Trends for 2013
Top Security Trends for 2013Top Security Trends for 2013
Top Security Trends for 2013
 
2010-05 Real Business, Real Threats! Don't be an Unsuspecting Target
2010-05 Real Business, Real Threats!  Don't be an Unsuspecting Target 2010-05 Real Business, Real Threats!  Don't be an Unsuspecting Target
2010-05 Real Business, Real Threats! Don't be an Unsuspecting Target
 
Security Intelligence
Security IntelligenceSecurity Intelligence
Security Intelligence
 
Cyber security and AI
Cyber security and AICyber security and AI
Cyber security and AI
 
itmsday2.pptx
itmsday2.pptxitmsday2.pptx
itmsday2.pptx
 
12 IoT Cyber Security Threats to Avoid - CyberHive.pdf
12 IoT Cyber Security Threats to Avoid - CyberHive.pdf12 IoT Cyber Security Threats to Avoid - CyberHive.pdf
12 IoT Cyber Security Threats to Avoid - CyberHive.pdf
 
IoT Security.pdf
IoT Security.pdfIoT Security.pdf
IoT Security.pdf
 
Top Cyber Security Interview Questions and Answers 2022.pdf
Top Cyber Security Interview Questions and Answers 2022.pdfTop Cyber Security Interview Questions and Answers 2022.pdf
Top Cyber Security Interview Questions and Answers 2022.pdf
 
The significance of the 7 Colors of Information Security
The significance of the 7 Colors of Information SecurityThe significance of the 7 Colors of Information Security
The significance of the 7 Colors of Information Security
 
Information Technology Security Basics
Information Technology Security BasicsInformation Technology Security Basics
Information Technology Security Basics
 
Role of Artificial Intelligence in Data Protection
Role of Artificial Intelligence in Data ProtectionRole of Artificial Intelligence in Data Protection
Role of Artificial Intelligence in Data Protection
 
Role of AI in Data Protection
Role of AI in Data ProtectionRole of AI in Data Protection
Role of AI in Data Protection
 
10 IT Security Trends to Watch for in 2016
10 IT Security Trends to Watch for in 201610 IT Security Trends to Watch for in 2016
10 IT Security Trends to Watch for in 2016
 
10 Things to Watch for in 2016
10 Things to Watch for in 201610 Things to Watch for in 2016
10 Things to Watch for in 2016
 
Information Security Intelligence
Information Security IntelligenceInformation Security Intelligence
Information Security Intelligence
 
vip_day_2._1130_cloud
vip_day_2._1130_cloudvip_day_2._1130_cloud
vip_day_2._1130_cloud
 
Trending it security threats in the public sector
Trending it security threats in the public sectorTrending it security threats in the public sector
Trending it security threats in the public sector
 
Pci compliance training agents
Pci compliance training  agentsPci compliance training  agents
Pci compliance training agents
 

Mehr von IT@Intel

It tools slideshare
It tools slideshareIt tools slideshare
It tools slideshare
IT@Intel
 

Mehr von IT@Intel (13)

IT@Intel: Creating Smart Spaces with All-in-Ones
IT@Intel:  Creating Smart Spaces with All-in-OnesIT@Intel:  Creating Smart Spaces with All-in-Ones
IT@Intel: Creating Smart Spaces with All-in-Ones
 
Unlock Hidden Potential through Big Data and Analytics
Unlock Hidden Potential through Big Data and AnalyticsUnlock Hidden Potential through Big Data and Analytics
Unlock Hidden Potential through Big Data and Analytics
 
Intel and IT- key industry trends driving business transformation
Intel and IT- key industry trends driving business transformationIntel and IT- key industry trends driving business transformation
Intel and IT- key industry trends driving business transformation
 
IT@Intel: Introducing IT on the Go
IT@Intel:   Introducing IT on the GoIT@Intel:   Introducing IT on the Go
IT@Intel: Introducing IT on the Go
 
Enterprise Video Hosting: Introducing the Intel Video Portal
Enterprise Video Hosting:  Introducing the Intel Video PortalEnterprise Video Hosting:  Introducing the Intel Video Portal
Enterprise Video Hosting: Introducing the Intel Video Portal
 
How to Self-Provision over WLAN with Intel(R) vPro(TM) Technology
How to Self-Provision over WLAN with Intel(R) vPro(TM) TechnologyHow to Self-Provision over WLAN with Intel(R) vPro(TM) Technology
How to Self-Provision over WLAN with Intel(R) vPro(TM) Technology
 
Jamming on Collaboration
Jamming on CollaborationJamming on Collaboration
Jamming on Collaboration
 
Accelerating Our Path to Multi Platform Benefits
Accelerating Our Path to Multi Platform BenefitsAccelerating Our Path to Multi Platform Benefits
Accelerating Our Path to Multi Platform Benefits
 
Deploying Intel Architecture-based Tablets with Windows* 8 at Intel
Deploying Intel Architecture-based Tablets with Windows* 8 at IntelDeploying Intel Architecture-based Tablets with Windows* 8 at Intel
Deploying Intel Architecture-based Tablets with Windows* 8 at Intel
 
Nurturing Innovation at Intel through Mindfulness
Nurturing Innovation at Intel through MindfulnessNurturing Innovation at Intel through Mindfulness
Nurturing Innovation at Intel through Mindfulness
 
Evaluating Microsoft Windows 8 Security on Intel Architecture Tablets
Evaluating Microsoft Windows 8 Security on Intel Architecture TabletsEvaluating Microsoft Windows 8 Security on Intel Architecture Tablets
Evaluating Microsoft Windows 8 Security on Intel Architecture Tablets
 
Best Practices for Cloud Security
Best Practices for Cloud SecurityBest Practices for Cloud Security
Best Practices for Cloud Security
 
It tools slideshare
It tools slideshareIt tools slideshare
It tools slideshare
 

Kürzlich hochgeladen

Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 

Kürzlich hochgeladen (20)

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 

Six Irrefutable Laws of Information Security

  • 1. Six Irrefutable Laws of Information Security
  • 2. IT Risk and Security Opposing Forces Locked Down Information assets should be fully protected Open Access Reduces cost and enables use of data and systems 2 Copyright © 2012 Intel Corporation. All rights reserved.
  • 3. IT Risk and Security A Balancing Act Open Access Reduces cost and How do we balance: enables use of data • Access to information? and systems • Protection of information? • Legal compliance? • Privacy of data? Locked Down Information assets • Cost of controls? should be fully protected 3 Copyright © 2012 Intel Corporation. All rights reserved.
  • 4. You can achieve balance in your security controls by understanding the Six Irrefutable Laws of Information Security1 and making choices about your design accordingly. 1 Phil Venables 2008, adapted from Scott Culp 2000, Pete Lindstrom 2008, and other sources
  • 5. Law 1 Information wants to be free. People have a natural tendency to share information with each other—through talk, posts, and email Sharing information creates potential for leakage. People may release information that shouldn’t be set free. But sharing also increases innovation. We need to make it safe to collaborate. * Other names and brands may be claimed as the property of others. 5 Copyright © 2012 Intel Corporation. All rights reserved.
  • 6. Law 2 Code wants to be wrong. Because people write code, it will never be 100 percent error-free. If intruders are smart and persistent, they will find a way into the software. There is no simple solution. We need to stay vigilant and ready to adjust security controls. 6 Copyright © 2012 Intel Corporation. All rights reserved.
  • 7. Law 3 Services want to be on. Services need to be left on so that processes and updates can run in the background. But when services are left on, security risk rises. People add to the risk by installing services like application updates. Services that “are always on” can potentially open a straight line into the system for the intruder. 7 Copyright © 2012 Intel Corporation. All rights reserved.
  • 8. Law 4 Users want to click. When people are connected to the Internet, they sometimes click on things without thinking. Curiosity can overcome judgment when people see interesting things on the Internet. Clicking on things make systems and people vulnerable. 8 Copyright © 2012 Intel Corporation. All rights reserved.
  • 9. Law 5 Even a security feature can be used for harm. The risks of code errors and services left on, leaves “holes” in security controls. Security controls are designed to create safety. But, like other software, security controls are created with code, and can be manipulated and coopted by hackers with malicious intent. 9 Copyright © 2012 Intel Corporation. All rights reserved.
  • 10. Law 6 The efficacy of a control deteriorates with time. We tend to set and forget about security controls, allowing them to lose effectiveness over time. Forgetting about security controls leaves systems open to risk. Hackers move fast; we need to move faster— and maintain an ongoing assessment of controls. 10 Copyright © 2012 Intel Corporation. All rights reserved.
  • 11. You may think you know a threat when it approaches… 11 Copyright © 2012 Intel Corporation. All rights reserved.
  • 12. … but don’t assume you recognize the true risk. 12 Copyright © 2012 Intel Corporation. All rights reserved.
  • 13. Risk surrounds and envelops us. Without understanding it, we risk everything, without capitalizing on it, we gain nothing.4 4 Glynis Breakwell – The Psychology of Risk 13 Copyright © 2012 Intel Corporation. All rights reserved.
  • 14. The most effective information security controls help you understand, manage, and balance the inevitable risks. If you want to know more… "Can Information Security Survive?" webinar Malcolm Harkins, Vice President and Chief Information Security Officer at Intel, talks about balancing business needs and growth with risk mitigation. 14 Copyright © 2012 Intel Corporation. All rights reserved.
  • 15. Learn more about Intel IT’s information security initiatives at: Intel.com/IT 15 Copyright © 2012 Intel Corporation. All rights reserved.