IT-Security (Chapter 3) Flashcards
Security Providers
The ICT industry •ICT is strategic asset •Focus on development •Growth strategy •Security is not a core competency
Security Consumers
Organizations using ICT •ICT is commodity •Focus on operations •Reputation to lose •Budget negotiations define decision to invest in security •Security is not a core competency
Interdependent Security
Own wellbeing depends on own and others security choices
Network Externalities - Connections create benefit
The value of a network is super-linear in the number of its users.
When to add security and where?
- When lack of security directly harms your own business.
- When you are big enough so that lack of security indirectly harms your reputation. →security for your users
- Where security helps your strategy, e. g., to lock customers in. →security against your users
IT Security Management
Definition: a process used to achieve and maintain appropriate levels of confidentiality, integrity, availability, accountability, authenticity and reliability.
Security Cycle
Check
Act
Plan
Do
Risk Assessment
- Establish Context: Determine broad risk exposure
- Identify assets
- Identify threats
- Analyze current safeguards
- determine likelihood of attacks
- Recommending controls that mitigate or eliminate risks
Alternatives to Risk Treatment
Risk acceptance Risk avoidance Risk transfer Reduce consequence Reduce likelihood
How to handle Attacks Technically
Prevention
Detection
Reaction
Recovery
Firewall
Allows just to enter at controlled points
Two Fundamental Policy Approaches (Firewall)
Default deny strategy vs. Default permit strategy
Goal ofIntrusion DetectionSystems
Supervision of computer systems and communication infrastructures in order to detect intrusions and misuse
Intrusion Prevention Systems (IPS)
IDS + Firewalls
Tasks of an Intrusion Detection System
- Audit
- Detection
- Response
