Chapter 1 - Introduction to Information Security Flashcards
Learning Objectives
Upon completion of this material, you should be able to:
- Define information security
- Recount the history of computer security and how it evolved into information security
- Define key terms and critical concepts of information security
- List the phases of the security systems development life cycle
- Describe the information security roles of professionals within an organization
Information Security Definition
a well-informed sense of assurance that the information risks and controls are in balance
Origins of information security
Started around the Second World War and continued on into the Cold War
What is ARPA & why was it created?
Advanced Research Project Agency 1960s to examine feasibility of redundant networked communications
Larry Roberts- ARPANET
ARPANET goal
The primary objective was to develop networking and resource sharing.
In its initial stages it had no security for dial-up connections (AKA authorization/passwords)
What was the Rand Report R-609? during what decades? and what was its major significance?
This was the paper that started the study of computer security and identified the role of management and policy issues in it
70s & 80s
Shift from physical security to information security: securing the data, limiting random/unauthorized access to the data, and tasking people directly with these duties.
What is MULTICS?
Multiplexed information and computing service
Several key players of MULTICS created UNIX primarily for text processing
90s
Internet became the first global network of networks
93 DEFCON conference for IS
Name 6 layers for security/protection:
- Operations
- Physical infrastructure
- People
- Functions
- Communications
- Information
CIA Triangle
CIA -
Confidentiality
Integrity
Availability
CNSS Security Model
The McCumber Cube
Committee on National Security Systems
Confidentiality
Integrity
Availability
Policy Education Tech
Storage/Processing/Transmission
This graphic informs the fundamental approach of the chapter and can be used to illustrate the intersection of information states (x-axis), key objectives of C.I.A. (y-axis), and the three primary means to implement (policy, education, and technology)
Information Systems (IS) definition
•is the entire set of people, procedures, and technology that enable business to use information.
–Software
–Hardware
–Data
–People
–Procedures
– Networks
Security as a balance b/w x and x
balance between protection and availability
Approaches to IS Implementation
- Bottom-up (grassroots effort) - rarely works due to little support and organizational staying power. Does have the advantage of having the technical expertise of individual administrators on its side.
- Top-down - carried out by upper mgmt. - policies, procedures, and processes, goals, and accountability. The most successful approach is referred to as systems development life cycle
What is the SDLC - systems development life cycle
- ): a methodology for the design and implementation of an information system
- Methodology: a formal approach to solving a problem based on a structured sequence of procedures
- Using a methodology:
–Ensures a rigorous process with a clearly defined goal
–Increases probability of success
Traditional SDLC consists of six general phases.
What are the 6 stages of the SDLC
- Investigation
- Analysis
- Logical Design
- Physical Design
- Implementation
- Maintenance and change
IALPIM
(inside ankle bone low practically immobilizes man)
SecSDLC
Using the same phases of SDLC to identify specific threats and create specific controls that counter them
Software Assurance (SwA)
CBK
Need to include planning for security obj. in SDLC used to create systems.
Common body of knowledge
Identified security principles:
- –Economy of mechanism
- –Fail-safe defaults
- –Complete mediation
- –Open design
- –Separation of privilege
- –Least privilege
- –Least common mechanism
- Psychological acceptability
Economy of mechanism: Keep the design as simple and small as possible.
Fail-safe defaults: Base access decisions on permission rather than exclusion.
Complete mediation: Every access to every object must be checked for authority.
Open design: The design should not be secret, but rather depend on the possession of keys or passwords.
Separation of privilege: Where feasible, a protection mechanism should require two keys to unlock, rather than one.
Least privilege: Every program and every user of the system should operate using the least set of privileges necessary to complete the job.
Least common mechanism: Minimize mechanisms (or shared variables) common to more than one user and depended on by all users.
Psychological acceptability: It is essential that the human interface be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly.
NIST Approach to Securing SDLC
maximizes return on investment through (4:)
NIST - National Institute of Standards and Technology
- –Early identification and mitigation of security vulnerabilities and misconfigurations
- –Awareness of potential engineering challenges
- –Identification of shared security services and reuse of security strategies and tools
- –Facilitation of informed executive decision making
CIO
CISO
Chief information officer - advises the senior executives on strategic planning
Chief information security officer - primarily assesses, manages, and implements IS and reports directly to CIO
Data owners
Members of senior management who are responsible for the security and use of a particular set of information. The data owners usually determine the level of data classification (discussed later), as well as the changes to that classification required by organizational change. The data owners work with subordinate managers to oversee the day-to-day administration of the data.
