Information Security and IoT Overview

Internet of Things (IoT)

• Connects personal, home devices, and vehicles to the Internet.
• Creates more potential data for theft.
• Cybersecurity is a national security responsibility.

Threats, Risks, and Vulnerabilities

• Risk: Level of exposure to a damaging event.
• Threat: Action that could damage an asset, natural or human induced.
• Vulnerability: Weakness that allows a threat to have an effect on an asset.

Information Systems Security

• Consists of hardware, operating systems, and applications.
• Security means being free from danger or risk.
• Involves safeguarding systems and data.

Tenets of Information Security: Confidentiality

• Protects private data of individuals, intellectual property, and national security.
• Cryptography: Practice of hiding data from unauthorized users.
• Encryption: Transforms data from cleartext into ciphertext.
• Ciphertext: Scrambled data resulting from encryption.

Tenets of Information Security: Integrity

• Maintains data accuracy.

Tenets of Information Security: Availability

• Measures how much time users can access systems, applications, and data.

Availability Time Measurements

• Uptime: Time when a system is operational.
• Downtime: When a system is not operational.
• Availability: Calculated by (Total Uptime) / (Total Uptime + Total Downtime).
• Mean Time To Failure (MTTF): Average time a system operates between failures.
• Mean Time To Repair (MTTR): Average time to fix a failed system.
• Mean Time Between Failures (MTBF): Average time between failures, including repair time.
• Recovery Point Objective (RPO): Max amount of data allowed to be lost in a disaster.
• Recovery Time Objective (RTO): Maximum amount of time acceptable for a system to be down after a failure.

Seven Domains of a Typical IT Infrastructure

• User Domain
• WAN Domain
• Remote Access Domain
• System/Application Domain
• LAN-to-WAN/Internet Domain
• Data Domain
• Security Domain

User Domain

• Roles and tasks: User access to systems, applications, and data based on their role.
• Threats: Unauthorized access, denial of service (DoS) attacks, distributed denial of service (DDoS) attacks, vulnerabilities in network equipment, configuration errors, data download, unknown file attachments, and lost productivity from web browsing.

WAN Domain

• Roles and tasks: Allows users access while ensuring data security.
• Responsibilities: Maintaining physical and logical components.
• Accountability: Ensuring compliance with security policies, standards, and guidelines.

Common Threats in the WAN Domain

• Open and public data.
• Vulnerable to eavesdropping.
• Vulnerable to malicious attacks.
• Vulnerable to DoS and DDoS attacks, TCP synchronize (SYN) flooding, and IP spoofing attacks.
• Vulnerable to information corruption.
• Insecure TCP/IP applications.
• Trojans, worms, and malware.

Common Threats in the WAN Domain: Connectivity

• Commingling of WAN IP traffic.
• Maintaining high WAN service availability.
• Maximizing WAN performance and throughput.
• Malicious use of Simple Network Management Protocol (SNMP) applications and protocols.

Remote Access Domain

• Roles and tasks: Allows mobile users to connect to IT systems over the internet.
• Responsibilities: Maintaining and troubleshooting remote connections..
• Accountability: Ensuring compliance with security standards and guidelines.

Common Threats in the Remote Access Domain

• Brute-force user ID and password attacks.
• Multiple logon retries and access control attacks.
• Unauthorized remote access.
• Private or confidential data compromise.
• Data leakage.
• Stolen laptops or authentication tokens.

System/Application Domain

• Roles and tasks: Includes hardware, software, applications, and data; secures mission-critical applications and intellectual property.
• Responsibilities: Server systems administration, database management, and design.
• Accountability: Ensuring compliance with security standards and guidelines.

Common Threats in the System/Application Domain

• Unauthorized access to data centers and infrastructure.
• Data breach.
• Data corruption or loss.
• Backup media reuse and loss.
• Recovery difficulties.
• Prolonged IT system downtime.

Weakest Link in IT Security: Humans

• People are often the source of security breaches.
• Strategies to reduce risk: Background checks, regular employee evaluations, access rotation, application testing, security plan review, and security audits.

Ethics and the Internet

• Digital behavior can be less mature than in real-life settings.
• High demand for systems security professionals.
• U.S. government and Internet Architecture Board (IAB) defined a policy regarding acceptable Internet use, but it's not a law.
• Systems security professionals are responsible for ethical conduct.

IT Security Policy Framework

• Policy: A short written statement defining a course of action for an organization.
• Standard: Detailed specification of rules, processes, or procedures.
• Procedure: Step-by-step instructions for executing a policy or standard.
• Guideline: Recommended practices or suggestions.
• Baseline: Common security configuration used as a starting point.