Introduction to Information Security

Module 1: Introduction to Information Security

• Information Assurance (IA) protects information systems, ensuring availability, integrity, authentication, confidentiality, and non-repudiation.
• Five pillars of IA: confidentiality, integrity, authentication, availability, and non-repudiation.
• Information security protects information and its systems from threats.
• Information security differs from cybersecurity, focusing on general information assets versus internet-connected systems.
• Six components of an information system: hardware, software, networks, data, people, and procedures.
• C.I.A. Triangle components: confidentiality (preventing unauthorized access), integrity (ensuring accuracy and unalteration), and availability (ensuring accessibility when needed).
• Security as an art involves creative problem-solving for unique organizational challenges.
• Security as a science relies on scientific principles and data-driven approaches to mitigate risks.
• Security as a social science examines how human behavior interacts with systems to improve security.
• Three layers of security in organizations: physical, technical, and administrative.
• A threat is a potential danger to information or systems, while a vulnerability is a weakness that a threat can exploit.
• Physical security controls include locks, badges, and surveillance cameras.
• Network security protects network components, connections, and content from unauthorized access.
• Operations security protects the details of operations to prevent exploitation.

Module 2: Legal, Ethical, and Professional Issues

• Due care involves acting legally and ethically, while due diligence continually ensures compliance.
• Policies are internal rules, while laws are legally enforceable.
• Criteria for enforceable policies include dissemination, review, comprehension, compliance, and uniform enforcement.
• Privacy protects personal information from unauthorized access.
• GDPR provides control over personal data and simplifies regulations.
• Personally Identifiable Information (PII) is data identifying an individual (name, SSN, financial details).
• Principles of the PH Data Privacy Act of 2012 include transparency, accountability, consent, and data minimization.
• Sarbanes-Oxley Act ensures accurate financial reporting and accountability.
• USA PATRIOT Act enhances tools to combat terrorism, including surveillance.
• Major U.S. Identity Theft Laws include the Identity Theft Enforcement and Restitution Act, Computer Fraud and Abuse Act, and Financial Modernization Act.

Module 3: Planning for Security

• Strategic planning in information security sets long-term directions for allocating resources and achieving objectives.
• Security policies provide a framework for protecting information assets.
• Differences exist between EISP (broad policies), ISSP (specific issues), and SysSP (technical guidance).
• Access Control Lists (ACLs) define access permissions for resources.
• Configuration rules govern system reactions to specific inputs.
• Policy administrators manage policy reviews, updates, and enforcement.
• Information Security blueprints detail plans for implementing security measures.
• ISO 27000 is an international standard for information security management.
• Defense in depth utilizes multiple layers of security for asset protection.
• A security perimeter separates secure and non-secure areas.

Module 4: Risk Management

• Risk management is the process of identifying, assessing, and controlling risks.
• Three phases of risk management include identification, assessment, and control.
• Qualitative risk analysis uses subjective assessments, while quantitative analysis uses numeric calculations.
• Single Loss Expectancy (SLE) calculates the financial impact of a single incident.
• Annualized Loss Expectancy (ALE) considers the frequency of occurrences.
• Exposure Factor (EF) represents the proportion of asset loss due to a threat.
• Risk control strategies include defense, transfer, mitigation, acceptance, and termination.
• Mitigation reduces impact through preparation.
• Cost-benefit analysis weighs control costs against benefits.
• DREAD model rates risks based on damage, reproducibility, exploitability, affected users, and discoverability.
• Benchmarking compares security practices against standards to identify gaps.
• Baselining establishes reference points for performance comparisons over time.
• Organizational and technical feasibility ensures alignment with objectives and resources.
• Residual risk remains after implementing feasible controls.
• Risk management frameworks provide structure for consistent risk assessment and control.
• Operational feasibility ensures user acceptance and integration of security into daily operations.
• Risk appetite is the level of risk an organization is willing to accept.
• Defense strategies prevent exploitation through safeguards and policies.
• Risk termination avoids activities that introduce unmanageable risks

Module 5: Overview of Vulnerability Assessment

• Vulnerability assessment identifies, quantifies, and prioritizes vulnerabilities.
• Vulnerability assessment distinguishes from penetration testing.
• Vulnerability assessment identifies and measures weaknesses, while penetration testing simulates attacks.
• Top 10 OWASP web vulnerabilities cover broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, identification and authentication failures, software and data integrity failures, security logging and monitoring failures, server-side request forgery.
• OWASP ZAP is a tool for identifying web application vulnerabilities.
• Assessment steps include asset identification, defining scope, prioritizing systems.
• Regular assessments identify emerging vulnerabilities.
• Configuration management ensures consistent system configurations.
• Reactive approaches respond to incidents after occurrence.
• Proactive approaches identify and address potential issues before exploitation.
• OWASP documentation provides best practices.
• Security patches fix vulnerabilities in software.