Introduction to Information Security

Introduction to Information Security

• Security is protection against loss, damage, or danger.
• Information security protects organizational data and systems from unauthorized actions.
• Information resources are exposed to various threats, vulnerabilities, and potential harm.

Increasing Vulnerability Factors

• Evolving IT Environment: Modern IT is complex, interconnected, and reliant on wireless networks, increasing exposure to external threats. Trusted networks are internal; untrusted are external. Wireless is vulnerable to interception.
• Advancements in Devices: Smaller, faster, cheaper, and more portable devices pose an easier target for theft, containing sensitive data.
• Decreasing Hacking Skills: Internet resources make hacking easier, enabling individuals with limited skills to attack systems.
• Rise of Organized Cybercrime: International organized crime groups increasingly involved in non-violent, lucrative cybercrime.
• Lack of Management Support: Senior management must prioritize security policies for organizational-wide adoption.

Unintentional Threats

• Unintentional threats are performed without malicious intent, but still pose a risk to information security.
• Human Error: A major unintentional threat, encompassing laziness, carelessness, and lack of security awareness. Employees at higher levels have greater access risk. Human Resources and Information Systems employees pose the greatest threat due to access to sensitive data. Contract workers and consultants also require consideration. Janitors and security guards also pose a threat due to their access and presence during off-hours, while not always accounted for in security plans.
• Social Engineering: Manipulating employees into revealing confidential information (passwords). Techniques include impersonation, tailgating (following employees into restricted areas), and shoulder surfing (observing screens).

Deliberate Threats

• Deliberate threats involve malicious intent.
• Espionage/Trespass: Unauthorized access attempts.
• Information Extortion: Threatening to steal or stealing information, demanding payment for avoiding harm, known as ransomware or digital extortion.
  • Methods of Attack: Spear phishing, whaling, ransomware;
  • Costs: Direct-ransom payment, indirect-file recovery costs, reputational damage, lawsuits.
  • Protection: User education, regular data backups, anti-ransomware software, the No More Ransom initiative, decryption tools.
• Sabotage/Vandalism: Deliberate acts such as defacing websites.
• Theft of Equipment/Information: Stealing devices containing sensitive data, like laptops, smartphones, and thumb drives. Dumpster diving is a technique involving searching through trash for discarded information.
• Identity Theft: Stealing another person's identity to gain access to financial information or implicating them in a crime.
• Intellectual Property: The unauthorized use of intellectual property, including trade secrets, patents, and copyrights. Trade secrets are confidential information, patents are inventions, and copyrights are creative works.
• Software Attacks: Malicious software targeting systems, including malware and evolving web-based attacks. Malware can target all connected devices like smart TVs.
• Alien Software: Clandestine software installations (not as damaging as viruses or worms). Examples include adware, spyware (including stalkerware for monitoring people), keyloggers, and spamware.
• Supervisory Control and Data Acquisition (SCADA) Attacks: Targeting industrial control systems, such as oil refineries, water treatment plants, and nuclear power plants. SCADA systems link physical operations with electronic control mechanisms, making access points vulnerable.
• Cyberterrorism/Cyberwarfare: Attackers using computer systems for physical harm or disruption to promote a political agenda.

Protecting Information Resources

• Risk Management: Identifying, controlling, minimizing the impact of threats, reducing risks to acceptable levels.
  • Risk Evaluation: Analyzing assets, their vulnerability to compromise, and costs of protection.
  • Risk Mitigation Strategies: Risk acceptance, transference (insurance), and limitation (controls) are three approaches.
• Information Systems Auditing: Evaluation and examination of information system controls and processes using established standards.
  • Types of Auditors: External, internal, government, specialist.
• COBIT 5: IT governance framework aligning IT with business needs, and managing risk. This involves five key principles to ensure stakeholder needs, an enterprise-wide approach, a single framework, holistic strategies, and separation of governance and management.

Information Security Controls

• Control Environment: Management’s attitude towards controls.
• General Controls: Apply to more than one functional area. Example, password management.
• Application Controls: Specific to an application, such as payroll approval.
• Physical Controls: Prevent unauthorized access to facilities (e.g., walls, locks).
• Business Continuity Planning: Prepare for disaster recovery, offering guidelines for responding to and recovering from disruptions affecting information security. This includes multiple-site and off-site data backups. Hot sites provide complete operations, warm sites offer operations without application software, while cold sites offer the basic utilities like electricity and building systems but do not provide IT operations.
• Access Controls: Restricting unauthorized use of information resources. Access Control has authentication and authorization.
• Authentication: Verifying user identity using various methods: something the user is (biometrics), has (ID card, token), does (voice, signature), or knows (passwords).
  • Password Managers: Generate and store complex passwords.
  • Multifactor Authentication (MFA): Combining multiple verification factors.
  • Passwordless Authentication: Password-free methods.
  • Adaptive Authentication: Authentication based on real-time risk assessments.
• Authorization: Establishing rights and privileges based on verified identity. Least privilege is a common principle.
• Communication Controls: Secure data transmission across networks.
  • Firewalls: Prevent unauthorized network traffic.
  • Anti-malware Systems: Detect and remove viruses and worms.
  • Whitelisting/Blacklisting: Controlling which software can run.
  • Encryption: Secure data transmission using public-key encryption and digital certificates.
  • Virtual Private Networks (VPNs): Securely extending networks over public networks.
  • Transport Layer Security (TLS): Secure communication protocol for online transactions (HTTPS).
• Application Controls: Security protection specific to applications (input, processing, and output controls).

Personal Information Asset Protection

• Protecting personal data is crucial when not connected to an organization's network.
• Inventorying/assessing sensitivity of data is the first step towards securing them.

Explore the crucial aspects of information security in this quiz. Understand the various vulnerabilities and threats that organizations face in today's interconnected IT environment. Test your knowledge of how advancements in technology and the rise of cybercrime impact data protection.