Information Security Lecture 08

Course Information

• Course code: CSSY1208
• Course title: Introduction to Information Security
• Lecture: 08 - Human Element Security
• Textbook: The Basics of Information Security, Understanding the Fundamentals of InfoSec in Theory and Practice, Second Edition, Jason Andress, Elsevier Publication
• Referenced Book: Cryptography and Network Security, 6th Edition, William Stallings, Pearson Publication

Chapter 8 - Human Element Security

• Introduction: Providing security against people (employees, contractors, partners, customers, service providers) is a major challenge in information security. Human behavior is unpredictable, and people can be vulnerable to both innocent mistakes and malicious attacks.

• Humans: The Weak Link: Security professionals focus on technical and physical controls but human errors (bad decisions) can easily negate those controls.

• Security Awareness: User awareness is crucial to ongoing security. Core items frequently addressed include protecting data, passwords, social engineering, network usage, malware, personal equipment, clean desks, and policy knowledge.

• Protecting Data: Data security is bound by numerous regulations (PCI-DSS, HIPAA, FERPA) impacting business practices.

• Compliance on Protecting Data: Maintaining data protection is necessary due to reputation management and customer retention concerns. Penalties (suspensions, fines, jail) can result from non-compliance. Regularly covering data security in training is vital.

• Passwords: Password security measures should balance complexity with the importance of what they protect. Strong passwords often include at least eight characters, upper and lower case letters, symbols, and numbers.

• Password Expiration: Password expiry policies (e.g., every 90 days) reduce password reuse risks. New passwords should not resemble previous ones.

• Passwords Syncing: Users manually synchronizing passwords across multiple systems increase security vulnerability.

• Passwords Misuse: Compromised password databases and exposure of login credentials are serious threats.

• Social Engineering: This involves exploiting trust and social behaviour to achieve malicious goals. Common examples include pretexting, phishing, spear phishing, tailgating, and baiting.

• Pretexting: Fraudsters impersonate trusted authorities. The victim reveals sensitive information in response to the staged scenario.

• Pretexting Scenario: Successfully social engineering a security guard might not be possible, and depends on the competence of the guard and the social engineer. Providing details of the organization is essential when attempting pretexting.

• Phishing: Exploiting email, texting, and calls to deceive users. Attackers send convincing emails, with links to fake sites and attempt to gather credentials and install malware.

• Spear Phishing: Targeted phishing campaigns focus on specific individuals or organizations, using detailed reconnaissance, increasing the success rate. Victims often trust the sender and perceive the information as legitimate.

• Tailgating: This is when an unauthorised person follows an authorised person through a restricted area.

• Malware: Malware (malicious software) includes viruses, worms, Trojans, ransomware, and spyware.

• Malware Sources: Malware often arrives from email attachments, shortened URLs, or non-official download sites. Pirated software is also a popular source.