information security management mis534. course outline – topics covered planning for security and...
TRANSCRIPT
![Page 1: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/1.jpg)
INFORMATION SECURITY MANAGEMENT
MIS534
![Page 2: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/2.jpg)
Course Outline – Topics Covered
Planning for Security and Contingencies
Information Security Policy Developing Security Programs Security Management Models Risk Management
• Identifying• Assessing• Controlling
![Page 3: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/3.jpg)
Course Outline – Topics Covered
Protection Mechanism Personnel and Security Law and Ethics Security and the Cloud
![Page 4: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/4.jpg)
Classroom Procedures
Most classes will contain the following components: Current Events Lectures Case Studies Project Presentations Various Speakers
Encourage student sharing their experiences
![Page 5: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/5.jpg)
Course Structure:
Assessments (3) 40%
Case Study/Exercises/Current Events 15%
Term paper 20%
Demo/Hands-on Lab Project 15%
Class Participation/Discussions 10%
![Page 6: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/6.jpg)
Term Paper
The primary purpose of this assignment is to provide you an opportunity to further develop practical research skills by investigating an information security and information assurance (IA) related topic (hopefully of personal interest).
Consists of:Executive summary of the topic (~ 1500 words)
include an annotated bibliography (with at least 8 references)
15-20 minutes presentation of your executive summary to class.
![Page 7: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/7.jpg)
Hands On/Lab Presentation
Prepare a presentation (5-7 minutes) and a live demonstration or hands-on lab exercise (20-25 minutes) on a security related technology.
Consists of:Student HandoutClass PresentationLive DemonstrationAnnotated Bibliography of useful resources
![Page 8: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/8.jpg)
Class Introductions/Expectations
Name
Background
Course Expectations
![Page 9: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/9.jpg)
Who I am
Dr. CummingsAssistant Professor at UNCW
Ph.D. in IS (Indiana University) MBA in IS (Texas Tech University) Industry experience in networking, programming, project
management.
![Page 10: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/10.jpg)
Careers in Information Security
Most studies/reports point to a shortage of security professionals over the next 5 years.
A Cisco 2014 Annual Security Report:• 500,000 global cybersecurity shortfall• 30,000 domestically
![Page 11: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/11.jpg)
CompTIA Security+
Entry-level certification
Requires 2 years experience working in network security
Credential holders possess expertise in knowledge areas such as • Cryptography• Identity management• Security systems• Security risk identification and mitigations• Network access control
![Page 12: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/12.jpg)
Certified Information Systems Security Professional
Five years of experience in information security There are 250 multiple-choice questions Exam duration: six hours
![Page 13: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/13.jpg)
Other Certifications
Systems Security Certified Practitioner Only one year of experience required Test is 90 minutes long, 50-70 questions
Certified Ethical Hacker
Certified Information Security Manager
![Page 14: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/14.jpg)
Introduction to Information Security Management
Do not figure on opponents not attacking;worry about your own lack of preparation.
BOOK OF THE FIVE RINGS
![Page 15: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/15.jpg)
Information Security Management
You can have all the protection mechanisms in place and still have security problems:
![Page 16: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/16.jpg)
Information Security Management
http://www.twincities.com/business/ci_24887125/target-breach-likely-an-inside-job-data-security
http://www.computerweekly.com/news/2240212475/Target-to-invest-5m-in-cyber-security-awareness
http://fortune.com/2014/12/30/new-research-sony-hack/
http://www.techrepublic.com/article/why-the-sony-hack-shouldnt-lead-to-the-end-of-user-centric-it/
http://www.businessweek.com/articles/2014-11-06/home-depot-hackers-got-in-via-a-vendor-took-53-million-e-mails-too
![Page 17: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/17.jpg)
Technology is not enough…..(From: PWC Global State of Information Security 2015)
Even the best technological solutions are being constantly worked on to circumvent.
Essential governance and operational processes:•Incident management response process•Classifying business value of data•Risk assessments on internal systems•Security Audits•Governance, risk and compliance
![Page 18: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/18.jpg)
Information Security Management(From: PWC Global State of Information Security 2014)
![Page 19: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/19.jpg)
Information Security Management
The goal of this course is to take a step back and examine how security functions as a whole within the organization.
Challenge:Everything cannot be categorized as right or wrong
What works for one company may fail in another
![Page 20: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/20.jpg)
Figure 1-1 The Enigma Source: Courtesy of National Security Agency
Early forms of Information Security
![Page 21: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/21.jpg)
The 1990s
Networks of computers became more common; so too did the need to interconnect networks
Internet became first manifestation of a global network of networks
In early Internet deployments, security was treated as a low priority
![Page 22: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/22.jpg)
2000 to Present
The Internet brings millions of computer networks into communication with each other—many of them unsecured
Ability to secure a computer’s data influenced by the security of every computer to which it is connected
Growing threat of cyber attacks has increased the need for improved security
![Page 23: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/23.jpg)
Introduction
The concept of computer security has become synonymous with the concept of information security
Information security is no longer the sole responsibility of a discrete group of people
in the company
![Page 24: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/24.jpg)
Information Security Decision Makers
1) Information security mgr and professionals (InfoSec Community)
2) Information technology mgr and professionals(Information Technology Community)
3) Non-technical business mgr and professionals (General Business Community)
![Page 25: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/25.jpg)
What Is Security?
• How do you define security?
• Specialized areas of security• Physical• Operations• Communications• Network
Each of these areas contribute to the information security program as a whole
![Page 26: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/26.jpg)
What Is Information Security?
What is Information Security?
How do we achieve Information Security?
PolicyTechnologyTraining and Awareness Programs
Role of information security is to protect an organization’s information assets
![Page 27: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/27.jpg)
Components of an Information SystemInformation system (IS) is entire set of components
necessary to use information as a resource in the organization Software Hardware Data People Procedures Networks
27
![Page 28: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/28.jpg)
Key Information Security Concepts
AccessAssetAttack Control, Safeguard,
or CountermeasureExploitExposure Loss
28
Protection Profile or Security Posture
Risk Subjects and Objects Threat Threat Agent Vulnerability
![Page 29: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/29.jpg)
Figure 1-1 Components of Information security
Source: Course Technology/Cengage Learninghttp://www.cnss.gov/policies.html
![Page 30: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/30.jpg)
CNSS Security Model (cont’d.)
C.I.A. triangle – Confidentiality, integrity, and availability – Has expanded into a more comprehensive list of
critical characteristics of information
NSTISSC (CNSS) Security Model – Provides a more detailed perspective on security– Covers the three dimensions of information security– Primary purpose: identify gaps in the coverage of an
information security program
![Page 31: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/31.jpg)
CNSS Security Model (cont’d.)
NSTISSC Security Model (cont’d.)– Must address all 27 cells when designing/reviewing a
program
Main Purpose: identify gaps in an information security program
![Page 32: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/32.jpg)
How to measure the value of information - CIA Triangle
IdentificationAuthentication AuthorizationPrivacyAccountability
Expanded toinclude
The value of information comes from the characteristics it possesses
![Page 33: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/33.jpg)
Confidentiality
The characteristic of information whereby only those with sufficient privileges may access certain information
Measures used to protect confidentiality:– Information classification– Secure document storage– Application of general security policies– Education of information custodians and end users
![Page 34: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/34.jpg)
Integrity
The quality or state of being whole, complete, and uncorrupted
Threats to information integrity:– Corruption– Damage– Destruction– Other disruption of its authentic state
![Page 35: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/35.jpg)
Availability
The characteristic of information that enables user access to information in a required format, without interference or obstruction
Availability does not imply that the information is accessible to any user (Implies availability to authorized users)
![Page 36: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/36.jpg)
Identification and Authentication
Identification– An information system possesses the characteristic of
identification when it is able to recognize individual users – Identification and authentication are essential to
establishing the level of access or authorization that an individual is granted
Authentication – Occurs when a control proves that a user possesses the
identity that he or she claims
![Page 37: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/37.jpg)
Authorization
Assures that the user has been specifically and explicitly authorized by the proper authority to access, update, or delete the contents of an information asset
Authorization occurs after authentication
![Page 38: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/38.jpg)
Privacy
Information collected, used, and stored by an organization is to be used only for the purposes stated to the data owner at the time it was collected
Privacy as a characteristic of information does not signify freedom from observation
Means that information will be used only in ways known to the person providing it
![Page 39: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/39.jpg)
Accountability
Exists when a control provides assurance that every activity undertaken can be attributed to a named person or automated process
![Page 40: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/40.jpg)
Balancing Information Security and Access
Should everyone have an access button?
Should information be kept in a vault?
![Page 41: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/41.jpg)
Balancing Information Security and Access
Impossible to obtain perfect security—it is a process, not an absolute
Security should be considered balance between protection and availability
![Page 42: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/42.jpg)
Principles of Information Security Management
Include the following characteristics that will be the focus of the current course (six P’s):
1. Planning2. Policy3. Programs4. Protection5. People6. Project Management
http://csrc.nist.gov/publications/PubsTC.html
![Page 43: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/43.jpg)
Planning
• Planning as part of InfoSec management– An extension of the basic planning model discussed
earlier in this chapter
• Included in the InfoSec planning model – Activities necessary to support the design, creation, and
implementation of information security strategies
![Page 44: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/44.jpg)
Planning (cont’d.)
• Types of InfoSec plans– Incident response planning– Business continuity planning– Disaster recovery planning– Policy planning– Personnel planning– Technology rollout planning– Risk management planning– Security program planning
• includes education, training and awareness
![Page 45: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/45.jpg)
Policy
• The set of organizational guidelines that dictates certain behavior within the organization
• Three general categories of policy: – Enterprise information security policy (EISP)– Issue-specific security policy (ISSP) – System-specific policies (SysSPs)
UNCW Policies
![Page 46: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/46.jpg)
Programs
• InfoSec operations that are specifically managed as separate entities– Example: a security education training and awareness
(SETA) program
• Other types of programs – Physical security program
• complete with fire, physical access, gates, guards, etc.
![Page 47: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/47.jpg)
Protection
• Executed through risk management activities
– Includes:– Risk assessment and control– Protection mechanisms– Technologies– Tools
• Each of these mechanisms represents some aspect of the management of specific controls in the overall information security plan
![Page 48: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/48.jpg)
People
Managers must recognize the crucial role that people play in the information security program
This area of InfoSec includes security personnel and the security of personnel, as well as aspects of a SETA program
The most critical link in the information security program
![Page 49: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/49.jpg)
Project Management
Identifying and controlling the resources applied to the project
Measuring progress
Adjusting the process as progress is made
![Page 50: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/50.jpg)
Summary
• What is security?• Principles of information security management
– Planning– Policy– Programs– Protection– People– Project management
![Page 51: INFORMATION SECURITY MANAGEMENT MIS534. Course Outline – Topics Covered Planning for Security and Contingencies Information Security Policy Developing](https://reader036.vdocuments.net/reader036/viewer/2022062716/56649de55503460f94adcd4a/html5/thumbnails/51.jpg)
Next Class
• Read Chapter 2 – Planning for Security
• Signup for Entropy • Lecture Slides and additional readings will be posted in the
calendar
• Teams and Topic Selections
• I will cover discussion of cases and current events next week but read them before class!