Threats To Information Security & Logical Access

Threats to Information Security & Logical Access
Information Security Management - Week 2 -
Thursday, March 1, 12
Information
Intelligence News Fact Data
Security
Safety Surety Protection
Information Security
Very wide scope From developing policies to implementation
of user access to a new le
Aspects in Information Security

Security Policy Organizational Security Asset Classication Personnel Security Physical Security
Aspects in Information Security

Communication & Operation Management Access Control System Development & Maintenance Business Continuity Planning Compliance
Secure
Improve
Security Policy
Monitor
Test
Organizational Security
Written Security Policy Framework for Implementing the Policy
Support from Senior Manager Security Awareness Program Report to Steering Committee Role of Business Unit in the Overall Security Process
Asset Classication
resource resource resource resource resource resource
Group
Group
Group
Personnel Security
Deals with people who work in the
organization.
Creating Job Desc. Performing Background checks. Helping in the recruitment process. User Training
Physical Security
CCTV Lighting Fence HVAC Backup Power
Communication & Operation Management

Ensuring no one has the ability to commit
and cover up a crime
Making sure the development system are

kept separate from production system disposed in a secure manner
Making sure that systems that are being
Access Control
Authentication Authorization
Routers Firewalls Desktop operating system File server Applications

System Development & Maintenance

Patch management Checking for security holes and proper
coding practices
Business Continuity Planning

Keep the systems running in the event of a
disaster
A formal plan must be written, tested, and

revised regularly
Compliance
Reviewing and testing an information
system for completeness and adequacy
Common Threats
Internal Threats External Threats 60%-80% network misuse comes from
inside enterprise
Information Security Triad

Integrity Condentiality Availability
Availability
Integrity
Condentiality
Integrity
The action of safeguarding the accuracy and
completeness of information and processing methods.
Condentiality
Ensuring that information is accessible only

to those authorized to have access to it.
Availability
Ensuring that authorized users have access
to information and associated assets when required.
Fault-Tolerant System
RAID (Redundant Array of Inexpensive
Disk)
Stripping & Mirroring
1 Errors & Omissions

Attack Integrity Component. Solution: Least Privilege. need add support staff Solution: Adequate & Frequent Backup.
2 Fraud & Theft

Attack Integrity Component. Solution: Well-dened Policies Solution: MD5 algorithm
3 Malicious Hacker
Hacker: Penetrate a system, look around
for possible things. destroy the data.
Cracker: Penetrate a system, damage/ Phreaks: Penetrate a phone system, use

organization phone.
Hacker Methodologies
Reconnaissance Scanning Gaining Access Maintaining Access Covering Tracks
4 Malicious Code
Any code that is designed to make a system
perform any operation with the knowledge of the system owner.
Virus, Worm, Trojan Horse, Logic Bomb.
5 Denial-of-Service
The attack makes sure thath no one gets
access to the network.
Ex: Flooding the system
6 Social Engineering
Manipulates others into revealing
information that can be used to steal data, access to systems, access to cellular phones, money, or even your own identity.
Human nature
The desire to be helpful A tendency to trust people The fear of getting into trouble The willingness to cut corner
Solution

Require anyone there to perform service to show proper identication. Establish a standard that passwords are never to be spoken over the phone. Implement a standard that forbids passwords from being left lying about. Implement caller ID technology for the help desk and other support functions. Invest in shredders and have one on every oor.
A Policy should be:

Not contain standards or directives that may not be attainable Stress what can be done and stay away from what is not allowed as much as possible Be brief and concise Be reviewed on a regular basis and kept current Be easily attainable by the employees and available via the company intranet
Task
Find a Potential Breach in your Campus Determine the Potential Threats.

Threats To Information Security & Logical Access

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Threats To Information Security & Logical Access

Uploaded by

Copyright:

Available Formats

Threats to Information Security & Logical Access

Information Security Management - Week 2 -

Aspects in Information Security

Aspects in Information Security

Communication & Operation Management

Making sure the development system are

Making sure that systems that are being

Routers Firewalls Desktop operating system File server Applications

System Development & Maintenance

Business Continuity Planning

A formal plan must be written, tested, and

Reviewing and testing an information

system for completeness and adequacy

Information Security Triad

Ensuring that information is accessible only

Stripping & Mirroring

1 Errors & Omissions

2 Fraud & Theft

Cracker: Penetrate a system, damage/ Phreaks: Penetrate a phone system, use

Virus, Worm, Trojan Horse, Logic Bomb.

Ex: Flooding the system

A Policy should be:

You might also like