Introduction to Information Security Module 1

The entire collection of software, hardware, data, people, procedures, and networks used to manage information within an organization.

The physical components of an IS, including computers, servers, routers, and other devices.

The programs and instructions that tell the hardware what to do, including operating systems, applications, and utilities.

The network of connections that allow data to flow between different parts of the information system.

The people who interact with the information system, including users, administrators, and developers.

The set of rules, guidelines, and processes that govern how people use the information system.

The raw facts and figures that are processed, stored, and retrieved by the information system.

Protecting the information system from unauthorized access, use, disclosure, disruption, modification, or destruction.

Preventing unauthorized access to copyrighted materials, using techniques like digital watermarks, embedded code, and copyright codes.

A legally binding agreement outlining the conditions for using software. Typically presented during installation.

Disruptions to essential services like power, internet, or communication networks that impact an organization's operations.

A form of availability disruption where the backup system cannot provide the full functionality of the primary system.

The potential loss of internet service due to outages or interruptions.

A contract between a web hosting provider and a client that outlines service levels and responsibilities.

Organizations that provide other essential services like power, internet, or communication, that can impact an organization's operations.

Penalties imposed on a service provider for failing to meet the agreed-upon terms of a Service Level Agreement (SLA).

A senior executive who champions the information security project and ensures its support.

A project manager who oversees the project's progress, understands personnel management, and possesses technical security knowledge.

Individuals who understand the organization's culture, policies, and the requirements for creating effective security policies.

Individuals who understand financial risk assessment, the value of organizational assets, and the security methods to safeguard them.

Dedicated and knowledgeable professionals specializing in all aspects of information security, both technical and non-technical.

People directly responsible for managing and administering the systems that store the organization's information.

Individuals who will be directly impacted by the new security system. They provide valuable feedback for realistic and practical controls.

Senior management members responsible for the security and use of a specific set of information. They determine data classification and oversee its management.

Individuals who work directly with data owners and are responsible for managing the information and the systems that process, transmit, and store it.

Threats from natural disasters like fires, floods, earthquakes, and even insect infestations. These events can disrupt operations and cause widespread damage.

A category of threats that includes unintended mistakes made by authorized users. These can stem from human error, inexperience, or failure to follow protocols.

A type of threat where an attacker or insider steals data and demands payment for its return or for an agreement not to disclose it.

A control implemented to minimize damage caused by forces of nature. Examples include emergency plans and backup systems.

Strategies to ensure critical business functions can continue, even during significant disruptions.

Procedures for handling cybersecurity incidents, including detection, response, and recovery.

A strategy for preventing human error by requiring users to double-check critical entries, ensuring accuracy.

A control that involves a second party reviewing and validating commands and actions, reducing the risk of human error.

A type of attack that uses forged or modified source IP addresses to trick systems into thinking messages come from a trusted source.

A technique where an attacker intercepts and modifies data packets traveling between two parties on a network.

A type of attack using malicious software to redirect users to fake websites, often disguised with a legitimate URL.

A method of stealing data by monitoring network traffic, often used to capture passwords, files, and sensitive information.

A social engineering attack that tricks users into clicking malicious links or revealing sensitive information.

Taking control of a legitimate TCP connection between two parties on a network, allowing the attacker to eavesdrop, alter, or redirect data.

A type of attack that exploits vulnerabilities in the Domain Name System (DNS) to redirect users to malicious websites.

A technique used to mimic legitimate entities on a network by using forged IP addresses.

Software and system applications that enhance the performance and user experience of a virtual machine's guest operating system.

Multiple layers of protection implemented by organizations to safeguard their information systems.

The process of importing a virtual appliance file (.ova) into a virtualization software like VirtualBox.

The balance between safeguarding valuable information and ensuring its accessibility for legitimate users.

A security measure that involves the systematic analysis of potential threats and their possible impact on an information system.

The ability to restore a system to its previous state in case of a failure or security breach.