Information Security 1 Flashcards
5 Pillars of Information Assurance
- Integrity
- Availability
- Confidentiality
- Authentication
- Non repudiation
role of information assurance
to protect and defend information and information systems
integrity
assurance that information is not tampered with
authentication
assuring those who have access in information, are they say who they are
availability
timely, reliable access to data for authorized users
confidentiality
assurance that information is not disclosed to unauthorized persons
non repudiation
someonewith access to your organizations
information system cannot deny having
completed an action within the system, as
there should be methods in place to prove
that they did make said action.
2011-2016 National Security
It is to ensure the permanent inviolability of our national territory and its effective control by the Government and the State.
Republic Act No. 8792
- recognizes use of electronic commercial and non-commercial transactions and electronic signature
- legal recognition to electronic data messages, electronic documents and electronic signatures
REPUBLIC ACT NO. 9995
protects the victims who are made to believe that they are performing sexual acts in private
Republic Act No. 10173
aims to protect personal data in information and communications systems both in the government and the private sector
REPUBLIC ACT NO. 9775
“Child” refers to a person below eighteen (18) years of age or over but is unable to fully take care of, or protect, himself/herself from abuse, neglect, cruelty, exploitation or discrimination because of a physical or mental disability or condition.
Republic Act No. 10175
completely address crimes committed against and by means of computer system
- prevents negligence
- the development and implementation of
policies and procedures to aid in performing the ongoing maintenance necessary to keep an information assurance process operating properly to protect assets and peoplefrom threats.
due care
due care
development and implementation of policies and procedures to did in performing the ongoing maintenance necessary to keep information assurance process operating properly to protect assets and people from threats
due diligence
is the reasonable investigation, research, and understanding of the risks an organization faces
before committing to a particular course of action. The organization should do its homework and ensure
ongoing monitoring.
Implications from lack of AI
- penalties from legal authorities
- loss of information assets
- customer loss
- loss of image and reputation
- operational losses and operational risk management
information assurance fundamental expectations and common beliefs
- be a business enabler
- protect interconnecting element of an organization’s systems
- be cost effective and cost benefitial
- establish responsibility and accountability
- require robust method
- be assessed periodically
- be restricted by social obligations
includes all information an organization may process, store, transmit, or disseminate regardless of media. Thus, information on paper, on a hard drive, in the mind of an employee, or in the cloud is considered to be “in scope.”
Information assurance
INFORMATION ASSURANCE AND SECURITY
PARTNER AGENCIES
- DOST ICT Office
- National Security Agency (NSA)
- National Bureau of Investigation (NBI) -Cybercime
Division - Philippine National Police
- DOJ Office of Cybercrime
- Data Privacy Commission
Memorandum Order No. 37, s. 2001
PROVIDING FOR THE FOURTEEN PILLARS OF POLICY AND ACTION OF THE GOVERNMENT AGAINST TERRORISM
Administrative Order No. 39, s. 2013
MANDATING GOVERNMENT AGENCIES TO MIGRATE TO THE GOVERNMENT WEB HOSTING SERVICE (GWHS) OF THE DEPARTMENT OF SCIENCE AND TECHNOLOGY-INFORMATION AND COMMUNICATIONS TECHNOLOGY OFFICE (DOST-ICTO)
Executive Order No. 810, s. 2009
INSTITUTIONALIZING THE CERTIFICATION SCHEME FOR DIGITAL SIGNATURES AND DIRECTING THE APPLICATION OF DIGITAL SIGNATURES IN E-GOVERNMENT SERVICES
ISO/IEC 27001:2005
specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization’s overall business risks.
PNS ISO/IEC 27002:2005
(Information technology — Security techniques — Code of practice for information security management)
Laws/Policies/Standards in force relating to cyber/information security (Abstract or summary of each document with URL pointing to authoritative source)
- 2011-2016 National Security Policy
- R.A. 8792 (E-Commerce Act)
- R.A. 9775 (Anti-Child Pornography Act of 2009)
- R.A. 9995 (Anti-Photo and Video Voyeurism Act of 2009)
- R.A. 10173 (Data Privacy Act of 2012)
- R.A. 10175 (Cybercrime Prevention Act of 2012)
- M.O. 37, s2001 (Providing for the Fourteen Pillars of Policy and Action of the Government Against Terrorism – critical infrastructure is defined in this document and requires the preparation of a comprehensive security plan [1][a] above)
- E.O. 810, s2009 (Institutionalizing the Certification Scheme for Digital Signature)
- A.O. 39, s2013 (Government Web hosting Service of DOST ICT Office
- PNS ISO/IEC 270001:2005 (Information technology — Security techniques — Information security management systems – Requirements)
- PNS ISO/IEC 27002:2005 (Information technology — Security techniques — Code of practice for information security management)
STRATEGIES OF INFORMATION ASSURANCE
- COMPREHENSIVE
- INDEPENDENT
- LEGAL AND REGULATORY REQUIREMENTS
- LIVING DOCUMENT
- LONG LIFE SPAN
- CUSTOMIZABLE AND PRAGMATIC
- RISK-BASED APPROACH
- ORGANIZATIONALLY SIGNIFICANT
- STRATEGIC, TACTICAL, AND OPERATIONAL
- CONCISE, WELLSTRUCTURED, AND EXTENSIBLE
COMPREHENSIVE
programs should cover topics, areas, and domains needed for modern organizations. Each topic, domain, and area within a policy should contain sufficient breadth and detail to support strategic, tactical, and operational implementation
A strategy should contain independent contents and perspectives related to the defined mission. Organizations are various sizes and use products and services from vendors
INDEPENDENT
must be consistent with existing laws and regulations
applicable to but not limited to information assurance, human resources, healthcare, finance, disclosure, internal control, and privacy within the organizational context.
LEGAL AND REGULATORY
REQUIREMENTS
organizations benefit from updated written policies,
procedures guidance, and standards to direct
operations. Organizations should use the ideas,
concepts, and approach outlined in this work to keep
their own policies, procedures, standards, and
practices up to date.
LIVING DOCUMENT
To increase the value and relevance of an organization’s information assurance strategy, the strategy must focus on the fundamentals of information assurance that remain constant over time
LONG LIFE SPAN
Organizations should adopt and adapt their tactical and operational plans to reflect identified organizational information assurance requirements and risk profiles.
CUSTOMIZABLE AND
PRAGMATIC
must be broad enough to give guidance to subcomponents with diverse risk profiles. This is analogous to risk portfolio approaches in finance
RISK-BASED APPROACH
should be considered significant in an organization’s strategy and ongoing operations, and it is a significant investment and area of concern for any organization.
ORGANIZATIONALLY
SIGNIFICANT
provides a framework to assist senior managers
and executives in making strategic (long-term)
planning and decisions.
STRATEGIC, TACTICAL,
AND OPERATIONAL
The structure and contents of the organization’s
information assurance strategy should
demonstrate high cohesion and low coupling.
CONCISE, WELL-STRUCTURED, AND EXTENSIBLE
Security Controls for IA
- PROTECTION OF CRITICAL AND SENSITIVE ASSETS
- COMPLIANCE TO REGULATIONS AND CIRCULARS/LAWS
- MEETING AUDIT AND COMPLIANCE REQUIREMENTS
- PROVIDING COMPETITIVE ADVANTAGE
Prior to implementing security controls, an
organization must identify the critical business
processes and value of the associated assets
PROTECTION OF CRITICAL AND
SENSITIVE ASSETS
the organization is required to analyze how the
requirements can be addressed without compromising the policies and procedures already available within the organization.
COMPLIANCE TO REGULATIONS AND
CIRCULARS/LAWS
is a process that checks and verifies compliance with
generally accepted standards, a particular
regulation, or a specific requirement
MEETING AUDIT AND COMPLIANCE
REQUIREMENTS
Frequently, individuals fail to recognize that
information assurance is a competitive advantage.
Organizations with proactive controls stay competitive and survive longer.
PROVIDING COMPETITIVE
ADVANTAGE
DEFENSE IN DEPTH
cannot be expected torespond to unknown and potentially urgent risk situations such as last-minute patches and catch-up planning, but it can reduce the
impact of such weaknesses
SIX CHARACTERISTICS-OF A
DEFENSE-IN-DEPTH STRATEGY
- Self-organizing
- Adapting to unpredictable situations
- Evolving in concert with an ever-changing environment
- Reactively resilient
- Proactively innovative
- Harmonious with system purpose
INFORMATION ASSET LIFE CYCLE
- create
- process
- use of transmission
- retain
- dispose
PLAN-DO-CHECK-ACT MODEL
- demonstrates the process of managing security throughout the life cycle
- includes implementation of continuous improvement process to attain an effective information management system
Boyd’s OODA Loop
Observe
Orient
Decide
Act
Boyd’s OODA Loop ORIENT
this step is designed to weed out bias and includes areas such as genetic heritage, cultural tradition, and previous experiences
Boyd’s OODA Loop OBSERVE
gather raw information about the situation at hand. be as accurate and thorough as possible
Boyd’s OODA Loop DECIDE
based on output of orientation, a decision is made to act
Boyd’s OODA Loop ACT
the action is performed
THE KILL CHAIN
US millitary targeting doctrine describes the kill chain as find, track, target, engage, and assess (FT2TEA)
Organizations and institutions exist to train and equip security professionals
- The International Information System Security Certification Consortium (ISC)2
- The Computing Technology Industry Association (CompTIA)
- Information System Audit and Control Association (ISACA)
- Information System Security Association (ISSA)
- SysAdmin, Audit, Network and Security (SANS)
- Disaster Recovery Institute, International (DRII)
- Business Continuity Institute (BCI)
PROFESSIONAL CERTIFICATIONS
