Information Assurance and Security I Quiz

Introduction to Information Security

• Course Title: Information Assurance and Security I (IT 107)
• Institution: Caraga State University - Main Campus, College of Computing and Information Sciences
• Information security is a "well-informed sense of assurance that the information risks and controls are in balance" (Jim Anderson, Inovant 2002)
• Understanding the origins of information security is necessary to grasp its importance today

Learning Objectives

• Understand the definition of information security.
• Comprehend the history of computer security and its evolution into information security.
• Understand key terms and critical information security concepts.
• Outline the security systems development life cycle.
• Understand the roles of security professionals within an organization.

The History of Information Security

• Began immediately after the first mainframes were developed.
• Created to aid code-breaking during World War II.
• Physical controls (badges, keys, facial recognition) were employed to limit access to sensitive military locations.
• Initial focus was on defending against physical theft, espionage, and sabotage

The Enigma Machine

• A cipher device used in the early to mid-20th century to protect communication.
• Employed extensively by Nazi Germany during World War II.
• The Germans believed it provided secure communication, although it was eventually cracked.

ARPANET

• One of the first documented computer security problems emerged in the early 1960s, with the increase in online mainframes.
• Advanced Research Projects Agency (ARPA) examined the feasibility of networked communications.
• Larry Roberts developed ARPANET.
• ARPANET became the first Internet.
• ARPANET faced growing popularity and misuse, leading to identified security issues.
• These issues included lack of safety procedures for dial-up connections, inadequate user identification and authorization, and the open sharing of login information.

The Origins of Computer Security

• Information security began with Rand Report R-069.
• Computer security grew from physical security to include data safety and limiting unauthorized access across organizational levels.

Late 1970s

• Microprocessors expanded computing capabilities and security concerns.
• The shift from mainframes to PCs created new threats and security concerns.
• The need for sharing computing resources increased.

1990s

• Networks of computers became more common, creating interconnection needs and security challenges.
• The Internet emerged as the first global network.
• Early Internet deployments often had low priority for security.
• Many Internet problems are a result of this early lack of adequate security measures.

The Present

• The Internet brings millions of computer networks into communication.
• The security of a computer's data is affected by the security of every connected computer.

What is Security?

• Security is defined as "the quality or state of being secure—to be free from danger."
• A successful organization requires multiple layers of security: physical, personal, operational, communications, network, and information.

What is Information Security?

• Protecting information and its critical elements (systems and hardware).
• Necessary tools include policy, awareness, training, education, and technology.
• Confidentiality, integrity, and availability (C.I.A.) were originally considered the key elements.
• Now expanded into a more extensive list of critical characteristics of information.

Components of Information Security

• The diagram shows interconnected components: information security, network security, computer & data security, and policy. Information security depends on all of them.

Critical Characteristics of Information

• Timeliness: Information's value is lost if it arrives too late.
• Availability: Uninterrupted access is crucial.
• Accuracy: Mistakes should be limited.
• Authenticity: The reliability and genuineness of the sender/information are important.
• Confidentiality: Information disclosure or exposure to unauthorized individuals.
• Integrity: The entirety, completeness, and accuracy of the information.
• Utility: Value for designated use, functionality, or application.
• Possession: Controlled access and ownership, including the responsibility of safeguarding data.

NSTISSC Security Model

• A framework that encompasses confidentiality, integrity, and availability.
• Encompasses the storage, processing, and transmission of data and includes consideration and implementation of suitable policies and procedures (e.g., education, technology).

Components of an Information System

• Information systems encompass software, hardware, data, people, procedures, and networks.
• Software is often the most difficult to secure and is a frequent target for attacks.
• Hardware concerns often involve physical security.
• Data is the most commonly targeted element in attacks. Data often contains valuable information.
• People compromise the security aspects the most often, and require security training to mitigate risks.
• Procedures are overlooked frequently in securing systems.
• Networks, especially connecting to the Internet, pose new security challenges; they are often insufficiently secured by relying only on local measures.

Balancing Information Security and Access

• Achieving perfect security is impossible; security is a continuous process, not an end goal.
• A balance must be struck between security protection and system availability.
• Security measures should permit reasonable access while safeguarding against threats.

Approaches to Information Security Implementation

• Bottom-up: System administrators attempt to improve system security. Technical expertise is the strength, but often lacks support and organization.
• Top-down: Upper-level managers dictate policy, procedures, goals, and outcomes.

The Systems Development Life Cycle (SDLC)

• A methodology and design for information security implementations, involving structured procedures and a defined goal.
• The methodology involves a sequence of phases (investigation, analysis, logical design, physical design, implementation, maintenance and change)

SDLC and SecSDLC

• Steps common to both SDLC and SecSDLC include outlining goals and estimating costs, examining feasibility, developing requirements and system plans, and performing further analysis to identify and document findings.
• Steps unique to SecSDLC include defining project processes, analyzing security policies and programs, identifying threats and controls, performing risk analyses, developing security blueprints, and planning strategies for handling incidents or disaster recovery.

Security Professionals and the Organization

• Implementing a comprehensive information security program requires a range of professionals, including senior management.
• Senior management plays a key role by creating policies, allocating resources, and overseeing program management.

Senior Management

• Senior Technology Officer (e.g., CIO) develops strategic plans for information management.
• Chief Information Security Officer (CISO) manages and implements information security initiatives.

Test your knowledge on the fundamentals of information security as covered in IT 107 at Caraga State University. This quiz covers the definitions, history, and key concepts in the field of information security. Gain insight into the roles of security professionals and the evolution of security practices over time.