Information Security Basics

Session Objectives

• Understand Information Security.
• Familiarize with some of the threats to I.S.
• Demonstrate knowledge of the security in the digital age.
• Appreciate the importance of I. S.
• Failure to secure creates opportunity to fail. Casey W. O'Brien said

Introduction

• Security of information is a key aspect of Information Management.
• Information needs to be kept secured.

What Is Security

• Security: The quality or state of being secure-to be free from danger.
• A successful organization will implement multiple layers of security.
• Security layers include Physical, personal, and operations security
• Computer security should not be confused with Information Security.
• Information security includes network and communications security.

What Is Information Security?

• It is the protection of information systems against unauthorized access or modification of information, whether in storage, processing or transit.
• Also protects against denial of service to authorized users or the provision of service to unauthorized users.
• Detection, documentation, and countering such threats is part of information Security.
• Includes both Electronic and Physical Security.
• Tools such as policy, awareness, training, education, and technology are necessary.
• The C.I.A. triangle has been considered the industry standard for computer security since the development of the mainframe, based on: confidentiality, integrity, and availability.
• The C.I.A. triangle can be expanded into a list of critical characteristics of information.
• Three widely accepted elements of information security are referred to as the "CIA Triad" / "CIA triangle".

Confidentiality

• Confidentiality limits information access and disclosure to authorized users/persons only.
• It is related to the broader concept of data privacy: limiting access to individuals' personal information.
• In Ghana one can refer to the Data Protection Act as a reason to keep data confidential.
• Use authentication methods, user-IDs & passwords can be used to control data systems access.

Integrity

• Information has integrity when it is whole, complete, and uncorrupted.
• It is threatened when exposed to corruption, damage, destruction, or other disruption.
• Data corruption can occur while information is being stored or transmitted.
• It includes, data that have not been changed inappropriately, be it by accident or on purpose.
• Means data came from correct entity, rather than impostor.

Availability (Recoverability)

• Availability enables authorized users-persons or computer systems-to access information without interference or obstruction, and to receive it in the required format.
• A research library identifying patrons, contents are protected allowing only authorized patrons is an example.
• An unavailable information system, makes it bad as if there was none at all

Maintaining A Balance

• A balance between confidentiality, integrity, and availability, should always be ensured.
• Confidentiality should not hinder access (availability) if access is paramount for business transactions.
• Security measure to ensure confidentiality may makes access to that information time-consuming, compromising accessibility/availability.

Information Security Threats

• Threat: A situation or an activity that could cause harm or danger (Macmillan English Dictionary, 2007).
• A threat is an object, person, or other entity that presents a constant danger to an asset.

Threats In Security

• Malware (a malicious software that creates inconvenience for the user. They include computer viruses, worms, trojan horses, bots, spyware, adware, etc).
• Malware, short for malicious software, consists of programs that act without a user's knowledge and deliberately alter the operations of computers and mobile devices.
• Spamming (Spams are unsolicited and mostly irrelevant messages sent on the internet to a large number of users).
• Phishing (occurs when an attacker attempts to obtain personal or financial information using fraudulent means, most often by posing as another individual or organization).
• Pharming

Other Information Security Threats

• Social Engineering:
• Password Attacks
• Threats to Privacy
• Network Attacks
• Identity Theft
• Each of these attacks could leverage one or more of the malware that were discussed earlier.

Social Engineering

• Relies on human interaction and psychological manipulation to trick users into making security mistakes or giving away sensitive information.
• Used to exploit human vulnerabilities, such as fear, urgency, curiosity, and trust.
• Common social engineering techniques, include phishing, pretexting, quid pro quo, baiting, and scare tactics
• Phishing emails or text messages, appear from legitimate source, such as a bank/ credit card company, to trick users into clicking on a malicious link or entering personal information.
• Pretexting, is when engineers pretend to be someone else such as a technical support representative/a law enforcement officer to gain the trust.
• In Baiting, engineers leave enticing objects, such as USB drives or CDs, in public places, hoping that someone will pick them up and plug them into their computer.
• Quid pro quo is when engineers offer value in exchange for something else such a gift card.
• Scare Tactic, warning of a virus or a compromised account creates urgency/panic

Examples Of Engineering Attacks

• In 2016, hackers used social engineering to steal $81 million from the Bangladesh central bank.
• Hackers sent phishing emails to bank employees, tricking them into revealing their login credentials.
• In 2013, Target was hacked after employees clicked on a phishing email that contained installed malware used to steal personal information.
• In 2011, Sony Pictures Entertainment was hacked after employees clicked phishing email that contained malware and stole personal information.

Protecting Yourself from Social Engineering.

• Be skeptical of emails/text messages that ask for personal information or contain unusual links and attachments.
• Be careful of what you share on social media.
• Use strong passwords and change them regularly.
• Be careful about what information you share with people you don't know and report any suspicious activity.
• Attackers are ALSO not dumb so attackers make better elaborate schemes to attack users
• Even corporate executives can be tricked into revealing information, never give out your password to ANYBODY.
• Password Guessing & Dictionary Attacks

Password Security

• Many Web sites require a username and password to access the information stored.
• Passwords prevent guessing
• Use strong passwords.
• Strong password has at least eight characters of upper- and lowercase letters and numbers.

Strong Password

• Characteristics includes at least eight or more characters
• It should not contain username, real name, or company name
• Is different from previous passwords used
• Contains upper- and lowercase letters, numbers, and special characters
• Does not contain complete dictionary word in any language

Class Activity

• "I was born in Accra, before 1990."
• Substituting the character < for the word before = IwbiA,<1990 COMPARE WITH THE PASSWORD YOU CREATED
• Born at 3:00 A.M. in Accra" = "Iwb@3:00AMIA”

Privacy

• The digital age has raised a lot of issues about privacy.
• Devices make data capturing easy and difficult to detect such as mobile

What Is Privacy?

• Freedom from observation, intrusion, or attention of others
• Society's needs sometimes trump individual privacy
• Privacy rights are not absolute
• A Balance is needed.
• Privacy and "due process”

Data Collection

• Forms like (Loans, insurance claims, magazine subscriptions, Schools, jobs)
• Voluntary Forms such as filling out a form, registering for a prize, supermarket "Rewards” cards
• Legal Involuntary sources (Demographics, Change of address, Various directories, Government records)

Privacy Policies

• Organizations usually warn public about cameras at premises. CCTV closed circuit television
• Beware, ALWAYS CHECK THE KEYPAD. use purse or wallet to obscure view from behind.

Categories Of Information Security

• Acts of human error or failure, Compromises to intellectual property, Deliberate acts of espionage or trespass, Deliberate acts of information extortion
• Deliberate acts of sabotage or vandalism, Deliberate acts of theft, Deliberate software attacks, Forces of nature, Deviations in quality of service from service providers
• Technical hardware failures or errors, Technical software failures or errors, Technological obsolescence

Why Is Information Security Important

• Organizations cannot function well with untrue information
• Enables safe operation of computer application that runs on IT network, prevent data theft
• Protect data collected by organizations, and law require companies to protects customer.

How Do We Keep Information Secured?

• At personal and Organizational level.
• Suggestions, passwords, ID Cards CCTV
• Policies and Strategies, awareness, training, education, technology

Summary

• Some specialist theorized that the bearer of info can not be protected 100%.
• Some specialist in the field, CIA triad is no longer sufficient, proposing an extended version for computer security.
• Information security is about people management focus should not be technology focused, and the like) alone.