Information Assurance and Security 1

Introduction to Information Security

• Information security is a growing concern in today's digital age
• Key concepts of information security include:
  • Confidentiality: protecting sensitive information from unauthorized access
  • Integrity: ensuring the accuracy and completeness of information
  • Availability: ensuring that information is accessible when needed

History of Information Security

• The history of information security began with computer security during World War II
• The need for computer security arose from the need to secure physical locations, hardware, and software from threats
• Key events in the development of information security include:
  • 1960s: Advanced Research Procurement Agency (ARPA) began examining the feasibility of a redundant networked communications system
  • 1970s and 80s: ARPANET grew in popularity, leading to concerns about misuse and the development of security safeguards
  • 1973: Robert Metcalfe and David Boggs developed Ethernet, a local area network (LAN) technology

Information Security Concepts

• Key terms and critical concepts of information security include:
  • Information security: the practice of protecting information and its systems from unauthorized access, use, disclosure, disruption, modification, or destruction
  • Information system: a set of interconnected components that collect, process, store, and disseminate information
  • Components of an information system:
    • Software
    • Hardware
    • Data
    • People
    • Procedures
    • Networks
• Approaches to information security implementation include:
  • Bottom-up approach: focusing on individual components and building up to the system as a whole
  • Top-down approach: focusing on the system as a whole and breaking it down into individual components
• The systems development life cycle includes:
  • Investigation
  • Analysis
  • Logical design
  • Physical design
  • Implementation
  • Maintenance and change
• The security systems development cycle includes:
  • Investigation
  • Analysis
  • Logical design
  • Physical design
  • Implementation
  • Maintenance and change

Communities of Interest

• Communities of interest are groups of individuals united by similar interests or values within an organization, sharing a common goal of helping the organization meet its objectives
• Examples of communities of interest include:
  • Information Security Management and Professionals
  • Information Technology Management and Professionals
  • Organizational Management and Professionals

Information Security Roles

• Senior management: responsible for making strategic decisions about information security
• Information security project team: responsible for implementing and maintaining information security systems
• Data responsibilities: include managing and protecting sensitive data

Information Security: Art or Science?

• Security as art: involves implementing security measures in a creative and flexible way, similar to a painter applying oils to canvas
• Security as science: involves following a rigorous and systematic approach to implementing security measures

Threats to Information Security

• Natural disasters:
  • Flood: an overflowing of water onto an area that is normally dry, causing direct damage to all or part of the information system
  • Earthquake: a sudden movement of the earth's crust caused by the release of stress accumulated along geologic faults or by volcanic activity
  • Lightning: an abrupt, discontinuous natural electric discharge in the atmosphere
  • Landslide or mudslide: the downward sliding of a mass of earth and rock
• Spoofing: a technique used to gain unauthorized access to computers by forging IP addresses
• Man-in-the-middle attack: an attacker monitors or sniffs packets from the network, modifies them, and inserts them back into the network
• Spam: unsolicited commercial email
• Mail bombing: an e-mail attack where an attacker routes large quantities of e-mail to the target, overwhelming the system.