ITEC 85 Flashcards
refers to the protection of information and information systems from unauthorized access
INFORMATION SECURITY
– refers to broader to a set of practices, policies, and procedures aimed at protecting the confidentiality
INFORMATION ASSURANCE
to hide a glaze recipe for pottery.
CRYPTOGRAPHY IN ANCIENT TIME
Firewalls
MEDIEVAL CASTLE
Codes
WORLD WARR ll AND THE ENIGMA MACHINE
– it is responsible for creating, managing, and using data
PEOPLE
is refer to the activities and procedures that are used to collect, store, process, and distribute information
- PROCESSES
is the raw material that is used by the information system
DATA
refers to the computer programs
- SOFTWARE
refers to the physical components of the information system
- HARDWARE
component of an information system includes the communication infrastructure
- NETWORKING
The birth of modern computing led to the development of computers
BIRTH OF MODERN COMPUTING AND EARLY THREATS
It is important elements of information security that help protect computer systems
PASSWORD AND ACCESS CONTROLS
refers to the time when the internet became widely accessible
INTERNET ERA
It is an effort to enhance information security
TRUSTED COMPUTING INITIATIVE
It is also known as asymmetric cryptography, is a method used in information security to secure communication
- PUBLIC – KEY CRYPTOGRTAPHY
refers to the increase in criminal activities that are conducted through the use of computers
- THE RISE OF CYBECRIME
refers to the protection of mobile devices
- MOBILE SECURITY
refers to the protection of data
cloud computing environments
- CLOUD SECURITY
refers to the measures and practices implemented to protect the security
- INTERNET OF THINGS (IoT) SECURITY
are sophisticated and targeted cyber-attacks that are carried out by skilled and persistent adversaries.
- ADVANCED PERSISTENT THREATS (APTs)
was an early computer worm that spread rapidly through vulnerable
- THE MORRIS WORM
refers to the measures and practices implemented to protect the security
- INTERNET OF THINGS (IoT) SECURITY
it pertains to laws and regulations that govern the protection and privacy of personal data.
- DATE PRIVACY REGULATIONS
5 BALANCING INFORMATION SECURITY AND ACCES:
- IMPLEMENT ACCESS CONTROL
- USE MULTI – FACTOR AUTHENTICATION
- EDUCATE USERS
- USE ENCRYPTION
- MONITOR USER ACTIVITY
5 APPROACHES TO INFORMATION SECURITY IMPLEMENTATION:
- RISK – BASED APPROACH –
- COMPLIANCE – BASED APPROACH -
- DEFENSE IN DEPTH APPROACH –
- HUMAN – CENTRIC APPROACH –
- TECHNOLOGY – FOCUSED APPROACH –
involves identifying and assessing risks to the organization’s information assets
- RISK – BASED APPROACH
involves implementing security controls to comply with regulatory requirements
- COMPLIANCE – BASED APPROACH
involves implementing multiple layers of security controls to provide redundancy
- DEFENSE IN DEPTH APPROACH
focuses on the role of people in information security.
- HUMAN – CENTRIC APPROACH
emphasizes the use of technology to protect information assets.
- TECHNOLOGY – FOCUSED APPROACH
SECURITY IN THE SDLC:
- PLANNING
- ANALYSIS
- DESIGN
- IMPLEMENTAION
- TESTING
- DEPLOYMENT
- MAINTENANCE
KEY TERMS AND CRITICAL CONCEPTS OF INFORMATION SECURITY:
- CONFIDENTIALITY
- INTEGRITY
- AVAILBILTY
- AUTHENTICATION
- AUTHORIZATION
- RISK MANAGEMENT
- THREATS
- VULNERABILITIES
- DEFENSE IN DEPTH
- INCIDENT RESPONSE
THE 2 NEEDS FOR SECURITY
THREATH (NOUN)
ATTACK (VERB)
possible security risk that might exploit the vulnerability of a system or asset.
THREATH (NOUN)
intentional unauthorized action on system.
ATTACK (VERB)
TWO TYPES OF ATTACKS:
- ACTIVE ATTACKS
- PASSIVE ATTACKS
an attempt to change system resources
- ACTIVE ATTACKS
an active attack is an attempt to change system resources
- PASSIVE ATTACKS
EXAMPLES OF THREATS AND ATTACK
- CYBERATTACKS
- PHYSICAL ATTACKS
- RERROISM
- THREAT OF VIOLENCE
- NATURAL DISASTER
- FINANCIAL FRAUD
EXAMPLES OF THREATS AND ATTACKS IN INFORMATION SECURITY
EXAMPLES OF THREATS AND ATTACKS IN INFORMATION SECURITY
* MALWARE
* PHISING
* DENIAL – OF – SERVICE (DOS)
* PASSWORD ATTACKS
* INSIDER THREATS
* PHYSICAL ATTACKS
DIFFERENT TYPES OF THREATS AND ATTACKS IN INFORMATION SECURITY
- ESPIONAGE OR TRESPASS –
- FORCES OF NATURE –
- HUMAN ERRO OR FAILURE –
- INFORMATION EXTORTION –
- SOFTWARE ATTACKS –
- TECHNOLOGICAL OBSALANCE
- THEFT –
INTELLECTUAL PROPERTY (IP) –
refer to illegal or unauthorized access to confidential information
Ex.
- Corporate Espionage
- Cyber Espionage
- Trespassing
- Physical Espionage
- Economic Espionage
- ESPIONAGE OR TRESPASS
refer to natural disaster such as floods, earthquakes, and hurricanes that can cause damage to computer systems
Ex.
- Weather Events
- Earthquakes
- Volcanic Eruptions
- Wildfires
- Tsunamis
- Power Outages
- Lightning Strikes
- FORCES OF NATURE
refers to mistakes made by individuals
- HUMAN ERRO OR FAILURE
It is a type of cybercrime in which the attacker threatens to publish.
- INFORMATION EXTORTION
refers to intentional damage
- SABOTAGE OR VANDALISM
refer to cyberattacks that exploit vulnerabilities in software applications.
- SOFTWARE ATTACKS
refers to the state where technology becomes outdated
- TECHNOLOGICAL OBSALANCE
it is the act of taking someone else’s property without their consent
- THEFT
refers to creations of the mind.
INTELLECTUAL PROPERTY (IP)
7 COMMON TERMS USED IN INTELLECTUAL PROPERTY
COMMON TERMS USED IN INTELLECTUAL PROPERTY
* PATENT
* TRADEMARK
* COPYRIGHT
* TRADE SECRET
* INFRINGEMENT
* LICENSING
* FAIR USE
enacted by governments to regulate behavior
LAWS
are rules that are established by regulatory agencies to enforce
REGULATIONS
refer to a set of moral principles and values that guide individual behavior
ETHICS
is a set of principles
CODE OF ETHICS
are associations of individuals
PROFESSIONAL ORGANIZATION
- INTERNATIONAL
- INTERNATIONAL
- International Association of Computer Science and Information Technology (IACSIT)
- Information System Security Association (ISSA)
- International Association of Privacy Professionals (IAPP)
- Cloud Security Alliance (CSA)
- LOCAL
- LOCAL
- Information Security Officers Group Philippines (ISOGP)
- Philippine Computer Emergency Response Team (PH-CERT)
- Philippine Society of Information Technology Educators (PSITE)
- Philippine Society of Information Security Professional (PSISP)
LAWS THAT AFFECTS THE PRATICE OF INFORMATION SECURITY
- DATA PRIVACY ACT OF 2012 (DPA)
- CYBERCRIME PREVENTION AST OF 2012
- E-COMMERCE ACT OF 2000
- ANTI-PHOTO AND VIDEO VOYEURISM ACT OF 2009
- NATIOANL PRIVACY COMMISSION (NPC)
