3. Course Outline – Topics Covered
Protection Mechanism
Personnel and Security
Law and Ethics
Security and the Cloud
4. Classroom Procedures
Most classes will contain the following components:
Current Events
Lectures
Case Studies
Term Paper Presentations
Encourage student sharing their experiences
5. Course Structure:
Assessments (3) 40%
Case Study/Exercises/Current Events 15%
Term paper 20%
Demo/Hands-on Lab Project 15%
Class Participation/Discussions 10%
6. Current Topics / Threat Predictions
The primary purpose of this assignment is to bring in current
topics that are occurring in the world of information security.
Choose 1 threat prediction for 2016 to research and present
during one of the sessions.
See threat predictions link on calendar and pick 3 possible
topics to research and present on. These will be assigned next
week to be presented throughout the semester.
7. Term Paper
The primary purpose of this assignment is to provide you an
opportunity to further develop practical research skills by
investigating an information security and information
assurance (IA) related topic (hopefully of personal interest).
Consists of:
Executive summary of the topic (~ 1500 words)
include an annotated bibliography (with at least 8 references)
15-20 minutes presentation of your executive summary to
class.
8. Hands On/Lab Presentation
Prepare a presentation (5-7 minutes) and a live demonstration
or hands-on lab exercise (20-25 minutes) on a security related
technology.
Consists of:
Student Handout
Class Presentation
Live Demonstration
Annotated Bibliography of useful resources
10. Who I am
Dr. Cummings
Assistant Professor at UNCW
Ph.D. in IS (Indiana University)
MBA in IS (Texas Tech University)
Industry experience in networking, programming, project
management.
11. Introduction to Information Security Management
Do not figure on opponents not attacking;
worry about your own lack of preparation.
BOOK OF THE FIVE RINGS
14. Technology is not enough…..
(From: PWC Global State of Information Security 2015)
Even the best technological solutions are being constantly
worked on to circumvent.
Essential governance and operational processes:
•Incident management response process
•Classifying business value of data
•Risk assessments on internal systems
•Security Audits
•Governance, risk and compliance
16. Information Security Management
The goal of this course is to take a step back and examine
how security functions as a whole within the organization.
Challenge:
Everything cannot be categorized as right or wrong
What works for one company may fail in another
17. Careers in Information Security
Most studies/reports point to a shortage of security
professionals over the next 5 years.
A Cisco 2014 Annual Security Report:
• 500,000 global cybersecurity shortfall
• 30,000 domestically
18. CompTIA Security+
Entry-level certification
Requires 2 years experience working in network security
Credential holders possess expertise in knowledge areas
such as
• Cryptography
• Identity management
• Security systems
• Security risk identification and mitigations
• Network access control
19. Certified Information Systems Security Professional
Five years of experience in information security
There are 250 multiple-choice questions
Exam duration: six hours
20. Other Certifications
Systems Security Certified Practitioner
Only one year of experience required
Test is 90 minutes long, 50-70 questions
Certified Ethical Hacker
Certified Information Security Manager
21. Figure 1-1 The Enigma Source: Courtesy of National Security Agency
Early forms of Information Security
22. The 1990s
Networks of computers became more common; so too did
the need to interconnect networks
Internet became first manifestation of a global network of
networks
In early Internet deployments, security was treated as a low
priority
23. 2000 to Present
The Internet brings millions of computer networks into
communication with each other—many of them
unsecured
Ability to secure a computer’s data influenced by the
security of every computer to which it is connected
Growing threat of cyber attacks has increased the need for
improved security
24. Introduction
The concept of computer security has become
synonymous with the concept of information security
Information security is no longer the sole responsibility
of a discrete group of people in the company
25. Information Security Decision Makers
1) Information security mgr and professionals
(InfoSec Community)
2) Information technology mgr and professionals
(Information Technology Community)
3) Non-technical business mgr and professionals
(General Business Community)
26. What Is Security?
• How do you define security?
• Specialized areas of security
• Physical
• Operations
• Communications
• Network
Each of these areas contribute to the
information security program as a whole
27. What Is Information Security?
What is Information Security?
How do we achieve Information Security?
Policy
Technology
Training and Awareness Programs
Role of information security is to protect an
organization’s information assets
28. Components of an Information System
Information system (IS) is entire set of components
necessary to use information as a resource in the
organization
Software
Hardware
Data
People
Procedures
Networks
28
29. Key Information Security Concepts
Access
Asset
Attack
Control, Safeguard, or
Countermeasure
Exploit
Exposure
Loss
29
Protection Profile or
Security Posture
Risk
Subjects and Objects
Threat
Threat Agent
Vulnerability
30. Figure 1-1 Components of Information security
Source: Course Technology/Cengage Learning
http://www.cnss.gov/policies.html
31. CNSS Security Model (cont’d.)
C.I.A. triangle
– Confidentiality, integrity, and availability
– Has expanded into a more comprehensive list of critical
characteristics of information
NSTISSI (CNSS) Security Model
– Provides a more detailed perspective on security
– Covers the three dimensions of information security
– Primary purpose: identify gaps in the coverage of an
information security program
32. CNSS Security Model (cont’d.)
NSTISSC Security Model (cont’d.)
– Must address all 27 cells when designing/reviewing a
program
Main Purpose: identify gaps in an information security program
33. How to measure the value of information - CIA Triangle
Identification
Authentication
Authorization
Privacy
Accountability
Expanded toinclude
The value of information comes from the
characteristics it possesses
34. Confidentiality
The characteristic of information whereby only those with
sufficient privileges may access certain information
Measures used to protect confidentiality:
– Information classification
– Secure document storage
– Application of general security policies
– Education of information custodians and end users
35. Integrity
The quality or state of being whole, complete, and
uncorrupted
Threats to information integrity:
– Corruption
– Damage
– Destruction
– Other disruption of its authentic state
36. Availability
The characteristic of information that enables user access to
information in a required format, without interference or
obstruction
Availability does not imply that the information is
accessible to any user (Implies availability to authorized
users)
37. Identification and Authentication
Identification
– An information system possesses the characteristic of
identification when it is able to recognize individual users
– Identification and authentication are essential to establishing the
level of access or authorization that an individual is granted
Authentication
– Occurs when a control proves that a user possesses the identity
that he or she claims
38. Authorization
Assures that the user has been specifically and explicitly
authorized by the proper authority to access, update, or
delete the contents of an information asset
Authorization occurs after authentication
39. Privacy
Information collected, used, and stored by an organization
is to be used only for the purposes stated to the data owner
at the time it was collected
Privacy as a characteristic of information does not signify
freedom from observation
Means that information will be used only in ways known to the
person providing it
40. Accountability
Exists when a control provides assurance that every activity
undertaken can be attributed to a named person or
automated process
43. Balancing Information Security and Access
Impossible to obtain perfect security—it is a process, not an
absolute
Security should be considered balance between protection
and availability
44. Security as Art
No hard and fast rules nor many universally accepted
complete solutions
No manual for implementing security through entire system
45. Security as Science
Dealing with technology designed to operate at high levels
of performance
Specific conditions cause virtually all actions that occur in
computer systems
Nearly every fault, security hole, and systems malfunction
are a result of interaction of specific hardware and
software
If developers had sufficient time, they could resolve and
eliminate faults
46. Principles of Information Security Management
Include the following characteristics that will be the focus
of the current course (six P’s):
1. Planning
2. Policy
3. Programs
4. Protection
5. People
6. Project Management
http://csrc.nist.gov/publications/PubsTC.html
47. Planning
• Planning as part of InfoSec management
– An extension of the basic planning model discussed earlier in this
chapter
• Included in the InfoSec planning model
– Activities necessary to support the design, creation, and
implementation of information security strategies
48. Planning (cont’d.)
• Types of InfoSec plans
– Incident response planning
– Business continuity planning
– Disaster recovery planning
– Policy planning
– Personnel planning
– Technology rollout planning
– Risk management planning
– Security program planning
• includes education, training and awareness
49. Policy
• The set of organizational guidelines that dictates certain
behavior within the organization
• Three general categories of policy:
– Enterprise information security policy (EISP)
– Issue-specific security policy (ISSP)
– System-specific policies (SysSPs)
UNCW Policies
50. Programs
• InfoSec operations that are specifically managed as
separate entities
– Example: a security education training and awareness (SETA)
program
• Other types of programs
– Physical security program
• complete with fire, physical access, gates, guards, etc.
51. Protection
• Executed through risk management activities
– Includes:
– Risk assessment and control
– Protection mechanisms
– Technologies
– Tools
• Each of these mechanisms represents some aspect of the
management of specific controls in the overall
information security plan
52. People
Managers must recognize the crucial role that people play in
the information security program
This area of InfoSec includes security personnel and the
security of personnel, as well as aspects of a SETA program
The most critical link in the information security program
53. Project Management
Identifying and controlling the resources applied to the
project
Measuring progress
Adjusting the process as progress is made
54. Summary
• What is security?
• Principles of information security management
– Planning
– Policy
– Programs
– Protection
– People
– Project management
55. Next Class
• Chapter 2 – Planning for Security
• Signup for Entropy
• Lecture Slides and additional readings will be posted in the
calendar
• Teams and Threat Prediction Selections
• I will cover discussion of cases and current events next
week but read them before class!
