Information Security (Chapter 4)

Information Security

        

 

Define Information Security

Information security refers to all of the processes and policiesdesigned to protect an organization’s information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

·        Five Factors Increasing the Vulnerability of Information Resources

1.     Today’s interconnected, interdependent, wirelessly-networked business environment

2.     Smaller, faster, cheaper computers and storage devices

3.     Decreasing skills necessary to be a hacker

4.     Organized crime taking over cybercrime

5.     Lack of management support

·        Human mistakes and social engineering

Human mistakes are unintentional errors. However, employees can also make unintentional mistakes as a result of actions by an attacker.

Social Engineering is an attack where the perpetrator uses social skills to trick or manipulate a legitimate employee into providing confidential company information.

·        Types of deliberate attacks

1.     Espionage or Trespass

2.     Information extortion

3.     Sabotage or vandalism

4.     Theft of equipment or information

5.     Identity theft

6.     Compromises to intellectual property

7.     Soft ware attacks

8.     Alien soft ware

9.     Supervisory control and data acquisition (SCADA) attacks

10.               Cyberterrorism and cyberwarfare

•       Types of risk mitigation strategies

1.     Risk Acceptance. Accept the potential risk, continue operating with no controls, and absorb any damages that occur.

2.     Risk limitation. Limit the risk by implementing controls that minimize the impact of threat.

3.     Risk transference. Transfer the risk by using other means to compensate for the loss, such as purchasing insurance.

•       Types of controls

1.     Physical controls. Physical protection of computer facilities and resources.

2.     Access controls. Restriction of unauthorized user access to computer resources; use biometrics and passwords controls for user identification.

3.     Communications (network) controls. To protect the movement of data across networks and include border security controls, authentication and authorization.