Video Content Lesson 1 Flashcards
Security Triad
CIA
Confidentiality
Integrity
Availability
Confidentiality
Protects from
Protects Data from Unauthorized Disclosure
Confidentiality
4 parts
Physical Security
Access Control
Encryption
Perimeter Defense
Integrity
Protects from
Protects Data from Unauthorized Modification
Integrity
3 parts
Physical Security
Access Control
Perimeter Defense
Availability
Ensures the system is available when needed
InfoSec Management Governance
1-Assurance that appropriate security activities are being carried out
2-Security risks are being reduced
3-Security budget is being properly used
Audit Frameworks for Compliance
1-COSO (Committee of Sponsoring Organizations of the Treadway Commission)
2-ITIL (Information Technology Infrastructure Library)
3-COBIT (Control Objectives for Information and related Technology)
4- ISO 17799 / BS 7799
COSO (Committee of Sponsoring Organizations of the Treadway Commission)
1-Defines 5 areas of internal control
2-Useful in meeting Sarbanes-Oxley Section 404 compliance
ITIL (Information Technology Infrastructure Library)
1-British government’s TSO (The Stationary Office)
2-Best practices for IT service management
COBIT (Control Objectives for Information and related Technology)
1-ITGI (IT Governance Institue)
2-Overall structure for Information Technology Control
ISO 17799 / BS 7799
1-Originially, UK Department of Trade and Industry Code of Practices
2-Basis for developing security standards and security management practices
Security Administration
1-Management is responsible to ensure security 2-Look at Security Goals a-Strategic - Long-term b-Tactical - Medium Term c-Operational - day-to-day
Organizational Requirements
1-Government or Commercial
2-Management Style and Organizational Culture
Physical Risks
Handling risks that can cause loss
Physical Damage
Hardware Malfunction
Software Malfunction
Human Risks
Malicious Attack
Espionage and theft
Human Errors
Risk Management
RM involves assessing risks and choosing appropriate responses
Risk Management Terms
Threat
Vulnerability
Probablility Determination
Control
Risk Management Options
Allow risk to exist
Reduce Loss
Legal Responsibility
Due Care
Due Dilligence
Risk Assessment Methodologies
A methodology is a starting point or a structure that helps the process begin NIST 800-30 and 800-66 OCTAVE FRAP (Facilitated Risk Analysis Process) CRAM (CCTA Risk Analysis Management)
NIST 800-30 and 800-66
1-Qualitative
2-800-66 written with HIPAA in mind
OCTAVE
Carnegie Mellons self-directed infromation security risk evaluation
Risk Assessment Team
1-Upper Management (most Important)
2-multiple departments
3-accept all input equally
4-document all proceedings
Risk Assessment
Types
Qualitative (no numbers, just comparisions)
Quantative (assign numberical value to risks)
Single Loss Expectancy
Calculate Exposure
1-Assign a value for each asset
2-Determine % of loss for each realized threat (Exposure Factor-EF)
Calculate the Loss of a single threat occurrence
1-Single Loss Expectancy (SLE)
SLE = Asset Value * EF
Annual Loss Expectancy
Calculate the annual probability of loss
Annual Rate of Occurrence (ARO)
Based on an estimage of annual probability a stated threat will be realized
Calculate the annual estimated loss of a specific realized threat
1-Annual Loss expectancy (ALE)
SLE * ARO = ALE
Overall Risk
Look at costs of risks and cost of controls
Qualiltative Risk Assessment
Ranked by impact and likelihood
Summarize each risk and its impact
Selecting Controls
Choose appropriate controls to mitigate risk
Value is always related to amount of loss a control prevents
Explore alternate options for expensive controls
Security Policy
Starts with Upper Management Policy 1-Statement of expected performance 2-Consequences of noncompliance Very High Level with Limited Specifics
Security Policy Types
1-Regulatory (mandatory to satisfy legal/regulatory requirments)
2-Advisory (things which we require as a business ex. ID)
3-Informative (explains organizational strategies and behavior)
Standards
What you must do
Lower level than policy
specify what products can be used (IE vs. Netscape)
specify best practices for each product
Compliance is mandatory (password expiry)
Guidelines
Recommended action/guide
typically not mandatory
provide details on how to implement standards
Procedures
“How to” documents
detailed step-by-step instructions
specific to well-defined areas
May have multiple sets of procedures
Job Policies and Training
1-Hiring Practices 2-Terminations Practices 3-Job Descriptions 4-Job Activities 5-Security Awareness 6-Tailoring Training 7-ISO Responsibilities
Hiring Practices
Background check
drug testing
security clearance
nondisclosure agreements
Terminations practices
Revocation of Privileges
Security Escort
Exit Interview
Job Descriptions
Roles and Responsibilities
Job Activities
Separation of Duties and responsibilities
Mandatory Vacation Increments (audit employee’s work)
Job Rotation
Security Awareness
most security incidents occur due to negligence
Awareness training informs and reminds participants and security responsibilities
Tailor training to match appropriate level of security needed
Various levels of training
Tailoring Training
1-management
2-non-technical staff
3-technical staff
ISO Responsibilities
ISO - Information Security Officer
Communicate risk to upper management
Budget for Infromation Security Activities
Ensure Development of (Policies, Procedures, Baselines, Standards, Guidelines)
Ethics
Overview (ISC)2 Code of Ethics Ten Commandments REC 1087 Ethics Topics Common Computer Ethics Fallacies
(ISC)2 Code of Ethics
Preamble Four Canons 1-protect society 2-act honorably, honestly 3-provide diligent service to principles 4-advance and protect the profession
Ten Commandments
Computer Ethics Institute
RFC 1087
Internet Activities Board
Ethics Topics
Computers in the Workplace Computer Crime Privacy and anonymity Intellectual property Professional Responsibilities
Ethics Fallacies
The Computer Game Fallacy The Law-abiding Citizen Fallacy The Shatterproof Fallacy The Candy-from-a-Baby Fallacy The Hacker's Fallacy The Free Information Fallacy
