Information Security 2 Flashcards
INFORMATION ASSURANCE
Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and
non-repudiation.
INFORMATION SECURITY
Preservation of confidentiality, integrity and availability of information. In addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved.
KEY PRINCIPLES OF
INFORMATION SECURITY
- confidentiality
- integrity
- availability
CONFIDENTIALITY
The act of protecting data from being observed by any
unauthorized persons
AVAILABILITY
The act in which Information is accessible by authorized users whenever they request the information
INTEGRITY
The act of maintaining and assuring the accuracy and completeness of data over its entire lifecycle
CYBERSECURITY
- is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment and organization and user’s assets.
- ensures the security and maintenance of the organization and user’s assets include the computing devices, personnel, infrastructure, applications, services, telecommunications systems and the totality of transmitted and/or stored information in the cyber environment.
The general security objectives comprise the following:
- Availability
- Integrity, which may include authenticity and non-repudiation
- Confidentiality
Organization and User’s
Assets
- personnel/user domain
- computing devices
- infrastructure
- network
- services
- telecommunications
- system/application
Cybersecurity vs. Information Security:
CYBERSECURITY
- all about protecting data that is found in electronic form (such as computers, servers, networks, mobile devices, etc.) from being compromised or attacked.
- Cybersecurity involves identifying what the critical data is, where it resides, its risk exposure, and the technology you have to implement in order to protect it
Cybersecurity vs. Information Security:
INFORMATION SECURITY
is another way of saying “data security.” For a more technical definition, NIST defines information security as “the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability.
Security of network and information systems Security of network and information systems
ability of network and information systems to resist, at a given level of confidence, any action that compromises the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the related services offered by, or accessible via, those network and information systems.
Phases of a Security Lifecycle
- identify
- prevent
- detect
- respond
- recover
IDENTIFY
developing the organisational understanding to manage cybersecurity risk to systems, assets, data and capabilities
PREVENT
safeguards to ensure delivery of critical infrastructure services
DETECT
activities to identify the occurrence of a cybersecurity event
RESPOND
activities to take action regarding a detected cybersecurity event
RECOVER
maintaining plans for resilience and restoring any capabilities or services impaired due to a cybersecurity event
DISCIPLINES CONTRIBUTING TO
INFORMATION SECURITY
- business
- economics
- education
- law
- mathematics
- psychology
BUSINESS
appreciating the organisational context in which the
protection is required and the importance of security in terms of areas such as maintaining brand reputation, supporting business continuity and minimising business risk.
ECONOMICS
understanding the value of security controls relative to costs of exposure and linking to factors such as return on (security) investment
EDUCATION
supporting areas such as user awareness and training, each being steps towards the boarder goal of achieving a security culture amongst the staff community
LAW
recognising the laws that require us to preserve security, and those relevant in a response to incidents, as well as linking to criminology in relation to understanding the nature and motivation of some of the attackers that may be faced
MATHEMATICS
providing the underpinnings for a variety of security techniques, including cryptography and access control.
