Legal & Ethical Issues in Info Security

Legal, Ethical, & Professional Issues in Information Security

• Information security involves protecting data and systems from unauthorized access, malicious attacks, and potential breaches
• Understanding security governance focuses on how organizations control their approach to security and achieve security goals.
• Security governance involves procedures, strategies, and necessary programs
• Information security governance is concerned with protecting information via digital and cybersecurity measures

Information Security Planning & Governance

• Security Measures: Protective actions to safeguard information and systems against unauthorized access, malicious attacks, and breaches. Specific types include encryption, firewalls, access controls, and intrusion detection systems (IDS).
• Security Policies: Rules and guidelines for protecting organizational information assets. Involves step-by-step instructions for implementing security measures, responding to threats, and consistent security practices.
• Physical and Environmental Protection: Measures to secure physical assets, including servers, data centers, and critical infrastructure, against damage, theft, and disruption (natural disasters, human error). Involves access controls, surveillance systems, and environmental controls (temperature, humidity, etc.)
• Monitoring Processes and Systems: Activities to continuously detect, record, and respond to security incidents, unusual activities, and unauthorized access attempts. Use systems like intrusion detection systems and security breach response tools for these actions.
• Asset Management: Identifying and managing organizational assets like hardware, software, data, and intellectual property. Includes activities like asset inventory maintenance, asset vulnerability assessments, and asset risk mitigation.

Information Security Policies & Standards

• Information Security Policy (ISP): A set of detailed rules, guidelines, and procedures to manage, protect, and distribute information assets in an organization. Goals include reducing data breaches, unauthorized access, and other security threats. It facilitates data integrity, availability, and confidentiality; protects sensitive data; and minimizes security risks. It also acts as a clear statement for third parties, helping with regulatory compliance.
• ISP Elements: Includes elements like purpose, scope, information security objectives, authorization and access control policy, data classification, data support and operations, security awareness sessions, and responsibilities of personnel.
• Policies as Living Documents: Policies need regular review, modification, and updating given evolving threats, regulatory changes, and stakeholder involvement. There are usually specific individuals/teams responsible for managing and updating the policy.
• Information Security Standards: Sets of documented processes and guidelines for implementing, managing, and monitoring security measures. Aims to mitigate security risks, vulnerabilities, and meet regulatory requirements. Example standards include ISO 27000 Series, NIST SP 800-53, and NIST CSF.
• Security Awareness Sessions: Sessions meant to educate and train personnel on security procedures and policies. The goal is to make people aware of policies and mechanisms meant to protect data within the ISP.

The Information Security Blueprint

• Blueprint Definition: A system or framework designed for selecting and implementing security attributes (protocols, management plans, risk mitigation).
• Blueprint Aim: To establish a strong security system to protect employees, clients, and the organization from risks.
• Blueprint Requirements: Scalable design, adaptability to growth, comprehensive compliance with standards and organizational needs, future-proofing, and mature algorithms and technological integration.
• Blueprint Main Concepts: In-depth security defense, unified security solutions, mature AI and ML algorithms, and technological integration.

Security Education, Training, & Awareness Programs (SETAs)

• Purpose: To improve employee awareness of the need to protect system resources; enhance their skills and knowledge related to security; and provide employees with in-depth knowledge about security program design, implementation, and operation.
• Elements: Education as "insight stage" (understanding operations, cybersecurity), training as "knowledge stage" (effectively performing duties), and awareness as "information stage" (understanding digital security).
• Importance of SETAs: Improved response to digital security/cybersecurity incidents, reduced breaches, improved effectiveness of existing security tools, enhanced employee security expertise, understanding of emerging threats, nurturing future cybersecurity talents, and improved compliance with standards/regulations.

Business Continuity Strategies

• Business Continuity Strategies Definition: Planned actions to maintain critical organizational functions during disruptions.
• Incident/Disruption Life Cycle: Includes actions for Prevention (take proactive steps to reduce impacts), Preparedness (planning for disruptions), Response (actions taken during a disruption), Recovery (restoring to normal/new stable state after disruption), and Mitigation (reducing future similar impacts).
• Developing Effective Business Continuity Strategy: Steps include risk assessment, developing a comprehensive strategy, stakeholder involvement, employee training, strategy testing, system backups, strategy updates, communication, partner collaboration, routine strategy review and improvement.