CH 4: Information Security

 Information Security

 the practice of defending information from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. It is a general term that can be used regardless of the form the data may take (e.g. electronic, physical)

                          

                                                      

Threat: any danger to which a system may be exposed

Exposure: the harm, loss or damage that can result if a threat compromises that resource

Vulnerability: the possibility that the system will suffer harm by a threat

Introduction to Information Security

Today’s interconnected, interdependent, wirelessly-networked business environment

untrusted network: any network external to your organization

Cybercrime: illegal activities conducted over computer networks , particularly the Internet 

                                           https://www.sans.org/information-security/

Unintentional Threats to Information    Systems

There are intentional and unintentional threats. Unintentional threats are considered to be human error, environmental hazards, and computer failures. Most people don't purposely cause harm. Intentional threats refer to purposeful actions resulting in the theft or damage of computer resources, equipment, and data. Intentional threats include viruses, denial of service attacks, theft of data, sabotage, and destruction of computer resources. Most intentional threats are viewed as computer crimes when executed.

Human Errors

Carelessness with laptops and portable computing devices

Opening questionable e-mails

Careless Internet surfing

Poor password selection

Social Engineering

 in the context of information security, refers to psychological manipulation of 

people into performing actions or divulging confidential information. A type 

of confidence trick for the purpose of information gathering, fraud, or system 

access, it differs from a traditional "con" in that it is often one of many steps in a 

more complex fraud scheme.

                                     

Tailgating: it occurs when an unauthorized person slips in through a door before                 it closes

Shoulder surfing: it occurs when the attacker watches another person’s

                            computer screen over that person’s shoulder

Deliberate Threats to Information Systems

Espionage or trespass: occurs when an unauthorized individual attempts to gain                                                    illegal access to organizational information 

Information extortion: occurs when an attacker either threatens to steal or                                                              actually steals information from a company

Sabotage or vandalism: defacing an organization's website

Theft of equipment or information

Pod slurping: perpetrator plugs portable device into a USB port in a                                              computer and downloads sensitive information

Dumpster diving: rummaging through commercial or residential trash to                                         find information that has been discarded

  Identity theft : assumption of another person’s identity, usually to gain access to                                      their financial information or to frame them for a crime

                  
   

Deliberate Threats to Information System

Compromises to Intellectual Property (IP)

Intellectual property (IP) is a legal term that refers to creations of the mind. Examples of intellectual property include music, literature, and other artistic works; discoveries and inventions; and words, phrases, symbols, and designs. Under intellectual property laws, owners of intellectual property are granted certain exclusive rights.

Trade secret: an intellectual work such as business plan, that is a company secret and not based on public information

Patent: a document that grants the holder exclusive rights on an                                           invention or process for 20 years.                        

Copyright: a statuary grant that provides the creator of IP with                                                      ownership of the property for  the life of the creator plus 70 years

Piracy: the illegal copying of software

                                    

Software attacks

Virus: a segment of computer code that performs malicious actions by attaching to another computer program.

Worm: a segment of computer code that spreads by itself and performs malicious                       actions without requiring another computer program

Trojan horse: a software program that hides in other computer programs and reveal                             its designed behavior only when it is activated.  A typical behavior of a                             Trojan horse is to capture your sensitive information (e.g., passwords,                             account numbers, etc.) and send them to the creator of the Trojan                                     horse.
Logic Bomb: a segment of computer code that is embedded within an                                                         organization’s existing computer programs and is designed to                                               activate and perform a destructive action at a certain time and date

Phishing attacks

use deception to acquire sensitive personal information by masquerading as official-looking e-mail

Denial-of-service attack

Attackers sends so many information requests to a target computer system that the system cannot handle them successfully, and typically crashes  

             

Alien Software

Alien is a computer program that converts between different Linux package formats, written by Joey Hess.

Keystroke loggers: record your keystrokes and your Web browsing history

Screen scrapers: record a continuous “movie” of what you do on a screen

Spamware: alien software that is designed to use your computer as a launchpad for spammers.  Spam is unsolicited  (unwanted)  e-mail

Cybercrime

is any crime that involves a computer and a network. The computer may have been used in the commission of a crime, or it may be the target.

Supervisory Control and Data Acquisition (SCADA) Attacks 

                                     

What Organizations Are Doing to Protect Information Resources

Risk: the probability that a threat will impact an information resource

Risk management: to identify, control and minimize the impact of threats.

Risk analysis: to assess the value of each asset being protected, estimate the probability it might be compromised, and compare the probable costs of it being compromised with the cost of protecting it.

Risk mitigation: is when the organization takes concrete actions against risk. It has                                   two functions:

*implement controls to prevent identified threats from occurring

* develop a means of recovery should the threat become a reality

Risk Acceptance: accept the potential risk, continue operating with no controls, and                                      absorb any damages that occur.

Risk limitation: Limit the risk by implementing controls that minimize the impact of                                 threat.

Risk transference: Transfer the risk by using other means to compensate for the loss,                                        such as purchasing insurance and having off-site backups  

                                               

Information Security Controls

re safeguards or countermeasures to avoid, counteract or minimize security risks relating to personal property, or any company property. For business-to-business facing companies whose service may affect the financial statements of the other company, the prospect may require successful audit reports of policy controls such as a SSAE 16 report before granting them authorization as a vendor.

Physical controls: physical protection of computer facilities and resources (Guards,                              doors, alarm systems)

Access controls: restriction of unauthorized user access to computer resources

Communications (network) controls: protect the movement of data across networks                                                                      and include border security controls,                                                                                           authentication and authorization.

Application controls: protect specific applications

Access Controls

Determines/confirms the identity of the person requiring access

Something the user is: access controls that examine a user's physiological or behavioral characteristics

Biometrics

Voice verification

Fingerprints

Retina scan

Something the user has : these access controls include regular ID cards, smart                                                cards

Something the user does : these access controls include voice and signature                                                      recognition

Something the user knows

Password : a private combination of characters that only the user                                  should know

  example: nam3-beeS

Passphrases: a series of characters that is longer than a password but                                        can be memorized easily

example: omanFT2brazilworldcup

Access Controls

Authorization

Determines which actions, rights or privileges the person has to do certain activities with information resources, based on his/her verified identity

Privilege: a collection of related computer system operations that can be                                performed by users of the system

Least privilege: a principle that users be granted the privilege for some activity                            only if there is a justifiable need to grant this authorization

CAPTCHA

an acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart") is a type ofchallenge-response test used in computing to determine whether or not the user is human

                                             

Communication / Network Controls

Firewall : is a network security system that controls the incoming and outgoing network traffic based on an applied rule set. A firewall establishes a barrier between a trusted, secure internal network and another network (e.g., the Internet) that is assumed not to be secure and trusted


                                     

Anti-malware systems: software packages that attempt to identify and eliminate viruses, worms, and other malicious software

                                       

Whitelisting: a process in which a company identifies the software that it will allow to                             run and does not try to recognize malware

Blacklisting: a process in which a company allows all software to run unless it is on                                    the blacklist

Intrusion detection systems: designed to detect all types of malicious network traffic                                              and computer usage that cannot be detected by a firewall 

Encryption: Process of converting an original message into a form that cannot                            be read by anyone except the intended receive                                                         

How Digital Certificates Work?

         is an electronic "passport" allowing people, computers or organizations to exchange                secure information over the Internet using the public key infrastructure (PKI).

Certificate authorities: trusted intermediaries between two organizations, issue digital certificates

                                              

Virtual private networking (VPN) : a private network that uses a public network (usually the                                                           Internet) to connect users

Secure Socket Layer now called transport layer security (TLS): is an encryption standard used for secure transactions such as credit card purchases and online banking.

Vulnerability management systems: (also called security on demand) extend the security perimeter that exists for the organization’s managed devices, to unmanaged, remote devices.

Virtual Private Network and Tunneling

Tunneling encrypts each data packet that is sent and places each encrypted packet inside another packet

Information Systems Auditing

Information systems auditing: Independent or unbiased observers task to ensure that information systems work properly.

Audit: Examination of information systems, their inputs, outputs and processing.

Types of Auditors and Audits:

Internal: Performed by corporate internal auditors.

External: Reviews internal audit as well as the inputs, processing and outputs of                      information systems.