Information Security Operations Chapter 2

Security Operations and Administration

• Security operations and administration involve a wide range of tasks and functions, including maintaining a secure environment for business functions and physical security of a campus and data center.
• A security professional should have a working familiarity with each of these tasks and functions.

Incident Response

• Incident response activities include:
  • Conducting investigations
  • Handling material that may be used as evidence in criminal prosecution and/or civil suits
  • Performing forensic analysis

Tools for Mitigating, Detecting, and Responding to Threats

• Common tools for mitigating, detecting, and responding to threats and attacks include:
  • Event logging to enhance security efforts
  • Knowledge of the importance and use of event logging

Disaster Recovery

• Security practitioners may need to manage how the organization deals with emergencies, including disaster recovery.

Supporting Business Functions

• Supporting business functions involves:
  • Incorporating security policy and practices with normal daily activities
  • Maintaining an accurate and detailed asset inventory
  • Tracking the security posture and readiness of information technology (IT) assets through the use of configuration/change management
  • Ensuring personnel are trained and given adequate support for their own safety and security

Complying with Codes of Ethics

• As a security professional, it is essential to:
  • Work, act, and think in ways that comply with and support the codes of ethics that are fundamental parts of the workplace, profession, and society at large
  • Adhere to and support the (ISC)2 Code of Ethics
  • Understand the needs of employers or clients
  • Listen, observe, gather data, and ask questions
  • Make recommendations, offer advice, or take action within the scope of job and responsibilities

(ISC)2 Code of Ethics

• The (ISC)2 Code of Ethics:
  • Requires strict adherence to the highest ethical standards of behavior
  • Includes a preamble that emphasizes the safety and welfare of society, duty to principals, and duty to each other
  • Consists of four canons or principles to abide by:
    • Protect society, the common good, necessary public trust and confidence, and the infrastructure
    • Act honorably, honestly, justly, responsibly, and legally
    • Provide diligent and competent service to principals
    • Advance and protect the profession

Organizational Code of Ethics

• Most organizations have a code of ethics that:
  • Shapes their policies and guides their decisions, setting goals, and taking actions
  • Guides the efforts of employees, team members, and associates
  • May be extended to partners, customers, or clients
  • Can be the basis of decisions to admonish, discipline, or terminate relationships with employees

Understanding Security Concepts

• Key security concepts include:
  • Confidentiality: limits on who is allowed to view the information, including copying it to another form
  • Integrity: the information stays complete and correct when retrieved, displayed, or acted upon
  • Availability: the information is presented to the user in a timely manner when required and in a form and format that meets the user's needs
  • Authenticity: only previously approved, known, and trusted users or processes have been able to create, modify, move, or copy the information
  • Utility: the content of the information, its form and content, and its presentation or delivery to the user meet the user's needs
  • Possession or control: the information is legally owned or held by a known, authorized user, such that the user has authority to exert control over its use, access, modification, or movement
  • Safety: the system and its information, by design, do not cause harm or damage to others, their property, or their lives
  • Privacy: information that attests to or relates to the identity of a person, or links specific activities to that identity, must be protected from being accessed, viewed, copied, modified, or otherwise used by unauthorized persons or systems
  • Nonrepudiation: users who created, used, viewed, or accessed the information, or shared it with others, cannot later deny that they did so
  • Transparency: the information can be reviewed, audited, and made visible or shared with competent authorities for regulatory, legal, or other processes that serve the public good### Information Security Concepts
• CIANA (Confidentiality, Integrity, Availability, Non-repudiation, and Authentication) is a framework for information security that emphasizes both non-repudiation and authentication.
• Confidentiality refers to the protection of sensitive information from unauthorized access, use, disclosure, disruption, modification, or destruction.
• Confidentiality involves sharing secrets with others, but with the agreement that they will not share that information with anyone else without consent.
• Examples of confidential information include:
  • Proprietary information
  • Trade secrets
  • Business plans
  • Private data
  • Customer information
  • Intellectual property

Intellectual Property

• Intellectual property refers to the ideas and expressions of those ideas that are protected by law.
• Types of intellectual property protection include:
  • Patents: protect ideas, processes, and procedures
  • Copyrights: protect artistic expressions of ideas
  • Trademarks: protect logos, symbols, and brand identities
  • Trade secrets: protect unpublished ideas and confidential information
• Intellectual property protection is essential for businesses and individuals to maintain a competitive advantage.
• Failure to protect intellectual property can lead to loss of business, revenue, and reputation.

Protecting Intellectual Property

• Protection of intellectual property involves:
  • Labeling and declaring ownership of the idea
  • Classifying and marking the information
  • Instituting procedures to enforce restrictions
  • Using digital rights management (DRM) and copy protection mechanisms
• Software and digital expressions are protected by copyright and licensed for use.
• Creative Commons licenses, also known as copyleft, allow for the free use of intellectual property with attribution.

Corporate Espionage

• Corporate espionage refers to the illegal gathering of information about competitors or rivals.
• It is a violation of confidentiality and can be considered a form of industrial or corporate espionage.
• Some nations encourage corporate espionage to gather business intelligence, while others consider it a violation of sovereignty.
• The boundary between corporate espionage and national intelligence services is often blurry.### Corporate-Level Espionage
• Corporate-level espionage activities may include:
  • Establishing business relationships to gain access to e-business information
  • Gathering product service or maintenance manuals and data
  • Recruiting key personnel from the target firm
  • Engaging in competitive information-seeking arrangements with suppliers, vendors, or customers
  • Probing and penetration efforts against the target's websites and online presence
  • Social engineering efforts to gather intelligence data
  • Unauthorized entry or breaking into the target's property, facilities, or systems
• All of these techniques can be used by third parties, such as hackers, to maintain plausible deniability

Integrity

• Integrity refers to the completeness, correctness, and reliability of information and processes
• In information systems, integrity applies to both the information and the processes that provide functions
• There are two ways to measure integrity:
  • Binary: either the system has integrity or it does not
  • Threshold-based: the system has a minimum level of integrity to function reliably

Trustworthiness

• Trustworthiness is perceptual and can be compromised by attacks such as Stuxnet
• Defense against compromised trustworthiness: find a separate and distinct means for verifying what systems are telling you

DIKW (Data, Information, Knowledge, Wisdom)

• Data: individual facts, observations, or elements of a measurement
• Information: data plus conclusions or inferences
• Knowledge: broader, more general conclusions or principles derived from lots of information
• Wisdom: insightful application of knowledge

Availability

• Availability refers to having the right information at the right time and in the right form
• Availability is key to making informed decisions
• There are three aspects of availability:
  • Information is available when needed
  • Information is in a usable form
  • Information is meaningful

Accountability

• Accountability refers to the need to know that investments in information and systems are paying off
• Organizations have three functional needs for accountability:
  • Gathering information about the use of corporate information and IT systems
  • Consolidating, analyzing, and auditing usage information
  • Using review results to inform decision-making

Privacy

• Privacy is the reasonable expectation that personal information and conversations will be kept confidential
• Privacy is separate and distinct from confidentiality
• Legal and cultural definitions of privacy abound, but fundamentally it means having control over who has access to personal information
• Businesses need to have a reasonable expectation that problems or issues will stay within the set of people who need to be aware of them and involved in their resolution

Privacy in Law and Practice

• Privacy is related to three main principles:
  • Restrictions on search and seizure of information and property
  • Self-incrimination
  • Disclosure of information held by the government
• The European Union's General Data Protection Regulation (GDPR) is a law that binds all persons, businesses, or organizations doing anything involving the data related to an EU person
• GDPR provides specific functional requirements for organizations' use of information and requires informed consent from users

Other Key Legal and Ethical Frameworks for Privacy

• Universal Declaration of Human Rights (Article 12)
• OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data

This quiz covers the day-to-day information security operations, where planning decisions are put into practice, including threat assessments and risk management.