Diese Präsentation wurde erfolgreich gemeldet.

information security management

2

Teilen

Wird geladen in …3
×
1 von 55
1 von 55

Weitere Verwandte Inhalte

Ähnliche Bücher

Kostenlos mit einer 14-tägigen Testversion von Scribd

Alle anzeigen

Ähnliche Hörbücher

Kostenlos mit einer 14-tägigen Testversion von Scribd

Alle anzeigen

information security management

  1. 1. INFORMATION SECURITY MANAGEMENT MIS534
  2. 2. Course Outline – Topics Covered  Planning for Security and Contingencies  Information Security Policy  Developing Security Programs  Security Management Models  Risk Management • Identifying • Assessing • Controlling
  3. 3. Course Outline – Topics Covered  Protection Mechanism  Personnel and Security  Law and Ethics  Security and the Cloud
  4. 4. Classroom Procedures Most classes will contain the following components:  Current Events  Lectures  Case Studies  Term Paper Presentations Encourage student sharing their experiences
  5. 5. Course Structure: Assessments (3) 40% Case Study/Exercises/Current Events 15% Term paper 20% Demo/Hands-on Lab Project 15% Class Participation/Discussions 10%
  6. 6. Current Topics / Threat Predictions The primary purpose of this assignment is to bring in current topics that are occurring in the world of information security. Choose 1 threat prediction for 2016 to research and present during one of the sessions. See threat predictions link on calendar and pick 3 possible topics to research and present on. These will be assigned next week to be presented throughout the semester.
  7. 7. Term Paper The primary purpose of this assignment is to provide you an opportunity to further develop practical research skills by investigating an information security and information assurance (IA) related topic (hopefully of personal interest). Consists of: Executive summary of the topic (~ 1500 words)  include an annotated bibliography (with at least 8 references) 15-20 minutes presentation of your executive summary to class.
  8. 8. Hands On/Lab Presentation Prepare a presentation (5-7 minutes) and a live demonstration or hands-on lab exercise (20-25 minutes) on a security related technology. Consists of: Student Handout Class Presentation Live Demonstration Annotated Bibliography of useful resources
  9. 9. Class Introductions/Expectations Name Background Course Expectations
  10. 10. Who I am Dr. Cummings Assistant Professor at UNCW  Ph.D. in IS (Indiana University)  MBA in IS (Texas Tech University)  Industry experience in networking, programming, project management.
  11. 11. Introduction to Information Security Management Do not figure on opponents not attacking; worry about your own lack of preparation. BOOK OF THE FIVE RINGS
  12. 12. Information Security Management You can have all the protection mechanisms in place and still have security problems:
  13. 13. Information Security Management http://www.twincities.com/business/ci_24887125/target-breach-likely- http://www.computerweekly.com/news/2240212475/Target-to-invest- http://fortune.com/2014/12/30/new-research-sony-hack/ http://www.techrepublic.com/article/why-the-sony-hack- shouldnt-lead-to-the-end-of-user-centric-it/ http://www.businessweek.com/articles/2014-11-06/home-depot- hackers-got-in-via-a-vendor-took-53-million-e-mails-too
  14. 14. Technology is not enough….. (From: PWC Global State of Information Security 2015) Even the best technological solutions are being constantly worked on to circumvent. Essential governance and operational processes: •Incident management response process •Classifying business value of data •Risk assessments on internal systems •Security Audits •Governance, risk and compliance
  15. 15. Information Security Management (From: PWC Global State of Information Security 2014)
  16. 16. Information Security Management The goal of this course is to take a step back and examine how security functions as a whole within the organization. Challenge: Everything cannot be categorized as right or wrong What works for one company may fail in another
  17. 17. Careers in Information Security Most studies/reports point to a shortage of security professionals over the next 5 years. A Cisco 2014 Annual Security Report: • 500,000 global cybersecurity shortfall • 30,000 domestically
  18. 18. CompTIA Security+ Entry-level certification Requires 2 years experience working in network security Credential holders possess expertise in knowledge areas such as • Cryptography • Identity management • Security systems • Security risk identification and mitigations • Network access control
  19. 19. Certified Information Systems Security Professional  Five years of experience in information security  There are 250 multiple-choice questions  Exam duration: six hours
  20. 20. Other Certifications Systems Security Certified Practitioner  Only one year of experience required  Test is 90 minutes long, 50-70 questions Certified Ethical Hacker Certified Information Security Manager
  21. 21. Figure 1-1 The Enigma Source: Courtesy of National Security Agency Early forms of Information Security
  22. 22. The 1990s Networks of computers became more common; so too did the need to interconnect networks Internet became first manifestation of a global network of networks In early Internet deployments, security was treated as a low priority
  23. 23. 2000 to Present The Internet brings millions of computer networks into communication with each other—many of them unsecured Ability to secure a computer’s data influenced by the security of every computer to which it is connected Growing threat of cyber attacks has increased the need for improved security
  24. 24. Introduction The concept of computer security has become synonymous with the concept of information security Information security is no longer the sole responsibility of a discrete group of people in the company
  25. 25. Information Security Decision Makers 1) Information security mgr and professionals (InfoSec Community) 2) Information technology mgr and professionals (Information Technology Community) 3) Non-technical business mgr and professionals (General Business Community)
  26. 26. What Is Security? • How do you define security? • Specialized areas of security • Physical • Operations • Communications • Network Each of these areas contribute to the information security program as a whole
  27. 27. What Is Information Security? What is Information Security? How do we achieve Information Security? Policy Technology Training and Awareness Programs Role of information security is to protect an organization’s information assets
  28. 28. Components of an Information System Information system (IS) is entire set of components necessary to use information as a resource in the organization  Software  Hardware  Data  People  Procedures  Networks 28
  29. 29. Key Information Security Concepts  Access  Asset  Attack  Control, Safeguard, or Countermeasure  Exploit  Exposure  Loss 29  Protection Profile or Security Posture  Risk  Subjects and Objects  Threat  Threat Agent  Vulnerability
  30. 30. Figure 1-1 Components of Information security Source: Course Technology/Cengage Learning http://www.cnss.gov/policies.html
  31. 31. CNSS Security Model (cont’d.)  C.I.A. triangle – Confidentiality, integrity, and availability – Has expanded into a more comprehensive list of critical characteristics of information  NSTISSI (CNSS) Security Model – Provides a more detailed perspective on security – Covers the three dimensions of information security – Primary purpose: identify gaps in the coverage of an information security program
  32. 32. CNSS Security Model (cont’d.)  NSTISSC Security Model (cont’d.) – Must address all 27 cells when designing/reviewing a program Main Purpose: identify gaps in an information security program
  33. 33. How to measure the value of information - CIA Triangle Identification Authentication Authorization Privacy Accountability Expanded toinclude The value of information comes from the characteristics it possesses
  34. 34. Confidentiality The characteristic of information whereby only those with sufficient privileges may access certain information Measures used to protect confidentiality: – Information classification – Secure document storage – Application of general security policies – Education of information custodians and end users
  35. 35. Integrity The quality or state of being whole, complete, and uncorrupted Threats to information integrity: – Corruption – Damage – Destruction – Other disruption of its authentic state
  36. 36. Availability The characteristic of information that enables user access to information in a required format, without interference or obstruction Availability does not imply that the information is accessible to any user (Implies availability to authorized users)
  37. 37. Identification and Authentication Identification – An information system possesses the characteristic of identification when it is able to recognize individual users – Identification and authentication are essential to establishing the level of access or authorization that an individual is granted Authentication – Occurs when a control proves that a user possesses the identity that he or she claims
  38. 38. Authorization Assures that the user has been specifically and explicitly authorized by the proper authority to access, update, or delete the contents of an information asset Authorization occurs after authentication
  39. 39. Privacy Information collected, used, and stored by an organization is to be used only for the purposes stated to the data owner at the time it was collected Privacy as a characteristic of information does not signify freedom from observation  Means that information will be used only in ways known to the person providing it
  40. 40. Accountability Exists when a control provides assurance that every activity undertaken can be attributed to a named person or automated process
  41. 41. Balancing Information Security and Access Should everyone have an access button? Should information be kept in a vault?
  42. 42. Balancing Information Security and Access Security Functionality Usability
  43. 43. Balancing Information Security and Access Impossible to obtain perfect security—it is a process, not an absolute Security should be considered balance between protection and availability
  44. 44. Security as Art No hard and fast rules nor many universally accepted complete solutions No manual for implementing security through entire system
  45. 45. Security as Science Dealing with technology designed to operate at high levels of performance Specific conditions cause virtually all actions that occur in computer systems Nearly every fault, security hole, and systems malfunction are a result of interaction of specific hardware and software If developers had sufficient time, they could resolve and eliminate faults
  46. 46. Principles of Information Security Management Include the following characteristics that will be the focus of the current course (six P’s): 1. Planning 2. Policy 3. Programs 4. Protection 5. People 6. Project Management http://csrc.nist.gov/publications/PubsTC.html
  47. 47. Planning • Planning as part of InfoSec management – An extension of the basic planning model discussed earlier in this chapter • Included in the InfoSec planning model – Activities necessary to support the design, creation, and implementation of information security strategies
  48. 48. Planning (cont’d.) • Types of InfoSec plans – Incident response planning – Business continuity planning – Disaster recovery planning – Policy planning – Personnel planning – Technology rollout planning – Risk management planning – Security program planning • includes education, training and awareness
  49. 49. Policy • The set of organizational guidelines that dictates certain behavior within the organization • Three general categories of policy: – Enterprise information security policy (EISP) – Issue-specific security policy (ISSP) – System-specific policies (SysSPs) UNCW Policies
  50. 50. Programs • InfoSec operations that are specifically managed as separate entities – Example: a security education training and awareness (SETA) program • Other types of programs – Physical security program • complete with fire, physical access, gates, guards, etc.
  51. 51. Protection • Executed through risk management activities – Includes: – Risk assessment and control – Protection mechanisms – Technologies – Tools • Each of these mechanisms represents some aspect of the management of specific controls in the overall information security plan
  52. 52. People Managers must recognize the crucial role that people play in the information security program This area of InfoSec includes security personnel and the security of personnel, as well as aspects of a SETA program The most critical link in the information security program
  53. 53. Project Management Identifying and controlling the resources applied to the project Measuring progress Adjusting the process as progress is made
  54. 54. Summary • What is security? • Principles of information security management – Planning – Policy – Programs – Protection – People – Project management
  55. 55. Next Class • Chapter 2 – Planning for Security • Signup for Entropy • Lecture Slides and additional readings will be posted in the calendar • Teams and Threat Prediction Selections • I will cover discussion of cases and current events next week but read them before class!

×