Information Security Management PDF

INFORMATION SECURITY MANAGEMENT CYBER 322 Technology is not enough….. (From: PWC Global State of Information Security 2015) Even the best technological solutions are being constantly worked on to circumvent. Essential governance and operational processes: Incident management response...

INFORMATION SECURITY MANAGEMENT CYBER 322 Technology is not enough….. (From: PWC Global State of Information Security 2015) Even the best technological solutions are being constantly worked on to circumvent. Essential governance and operational processes: Incident management response process Classifying business value of data Risk assessments on internal systems Security Audits Governance, risk and compliance Information Security Management The goal of this course is to take a step back and examine how security functions as a whole within the organization. Challenge: Everything cannot be categorized as right or wrong What works for one company may fail in another Early forms of Information Security Figure 1-1 The Enigma Source: Courtesy of National Security Agency The 1990s Networks of computers became more common; so too did the need to interconnect networks Internet became first manifestation of a global network of networks In early Internet deployments, security was treated as a low priority 2000 to Present The Internet brings millions of computer networks into communication with each other—many of them unsecured Ability to secure a computer’s data influenced by the security of every computer to which it is connected Growing threat of cyber attacks has increased the need for improved security Introduction The concept of computer security has become synonymous with the concept of information security Information security is no longer the sole responsibility of a discrete group of people in the company What Is Security? How do you define security? In general, security means being free from danger. To be secure is to be protected from the risk of loss, damage, unwanted modification and other hazards. Specialized areas of security p. 4 Physical : The protection of physical items, objects, or areas from unauthorized access and misuse. Operations : The protection of the details of an organization's operations and activities. Communications : The protection of all communications media, technology, and content. Network: A subset of communications security and cybersecurity; the protection of voice and data networking components, connections, and content. Each of these areas contribute to the information security program as a whole What Is Information Security? What is Information Security (infoSec)? Focuses on the protection of information and the characteristics that give it value, such as confidentiality, integrity, and availability, and includes the technology that houses and transfers that information through a variety of protection mechanisms such as policy, training and awareness programs, and technology. How do we achieve Information Security? ❑ Policy ❑ Technology ❑ Training and Awareness Programs Role of information security is to protect an organization’s information assets What Is Information Security? Components of an Information System Information system (IS) is entire set of components necessary to use information as a resource in the organization ▪ Software ▪ Hardware ▪ Data ▪ People ▪ Procedures ▪ Networks 11 Key Information Security Concepts p. 11 Access Protection Profile or Asset Security Posture Attack Risk Control, Safeguard, or Subjects and Objects Countermeasure Threat Exploit Threat Agent Exposure Vulnerability Loss 12 CNSS Security Model ❑ C.I.A. triangle – Confidentiality, integrity, and availability – Has expanded into a more comprehensive list of critical characteristics of information ❑ NSTISSI (CNSS) Security Model – Provides a more detailed perspective on security – Covers the three dimensions of information security – Primary purpose: identify gaps in the coverage of an information security program  CNSS Security Model (cont’d.) Committee on National Security Systems (CNSS) defines information security as the protection of information and its critical elements, including the systems and hardware that use, store, and transmit that information. The CNSS Model of information security evolved from a concept developed by the computer security industry called the C.I.A triangle. The below figure shows that information security includes broad areas of information security management, computer and tata security, and network security. From : https://sohail.life/3726/the-cnss-security-model-how-would-you-address-them-in-your- organization/ http://www.cnss.gov/policies.html Source: Course Technology/Cengage Learning CNSS Security Model (cont’d.) ❑ NSTISSC Security Model (cont’d.) – Must address all 27 cells when designing/reviewing a program Main Purpose: identify gaps in an information security program How to measure the value of information - CIA Triangle The value of information comes from the characteristics it possesses Identification Authentication Authorization Privacy Accountability Confidentiality The characteristic of information whereby only those with sufficient privileges may access certain information Measures used to protect confidentiality: – Information classification – Secure document storage – Application of general security policies – Education of information custodians and end users Integrity The quality or state of being whole, complete, and uncorrupted Threats to information integrity: – Corruption – Damage – Destruction – Other disruption of its authentic state Availability The characteristic of information that enables user access to information in a required format, without interference or obstruction Availability does not imply that the information is accessible to any user (Implies availability to authorized users) Identification and Authentication Identification – An information system possesses the characteristic of identification when it is able to recognize individual users – Identification and authentication are essential to establishing the level of access or authorization that an individual is granted Authentication – Occurs when a control proves that a user possesses the identity that he or she claims Authorization Assures that the user has been specifically and explicitly authorized by the proper authority to access, update, or delete the contents of an information asset Authorization occurs after authentication Privacy Information collected, used, and stored by an organization is to be used only for the purposes stated to the data owner at the time it was collected Privacy as a characteristic of information does not signify freedom from observation ▪ Means that information will be used only in ways known to the person providing it Accountability Exists when a control provides assurance that every activity undertaken can be attributed to a named person or automated process What is Management? Management : The process of achieving objectives by appropriately applying a given set of resources. Leadership :The process of influencing others and gain ing their willing cooperation to achieve an objective by providing purpose, direction, and motivation. In its most basic form, management involves using resources to get a job done. Management Characteristics The management of tasks requires certain basic skills. These skills are variously referred to as "management characteristics,“ "management functions;' "management principles; or "management responsibilities.“ The two basic approaches to management are: Traditional management theory- This approach uses the core principles of planning, organizing, staffing, directing, and controlling {POSDC). Popular management theory- This approach uses the core principles of planning, organizing, leading, and controlling (POLC). Management Characteristics Planning: The process of developing. creating, and implementing strategies for the accomplishment of objectives. Organizing :The management function dedicated to the structuring of resources to support the accomplishment of objectives. … It includes the structuring of departments and their associated staffs, the storage of raw materials to facilitate manufacturing, and the collection of information to aid in the accomplishment of the task. Leading encourages the implementation of the planning and organizing functions. It includes supervising employee behavior, performance, attendance, and attitude while ensuring completion of the assigned tasks, goals, and objectives. controlling ensures the validity of the organization's plan. The manager ensures that sufficient progress is made.. What is Management? Governance The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise's resources a re used responsibly. For most organizations that have such a governing body, it exists either at the board of directors level or the senior executive level. This level of uppermost management is referred to as governance. Just as there are governance functions to manage the entire business side of the organization. InfoSec, governance provides addressing risk management, performance measures, and compliance. Solving Problems Step 1: Recognize and Define the Problem.. Ex: spam, e-mails or signed up for notifications and mailing lists? Step 2: Gather Facts and Make Assumptions the problem of excessive e- mail is, in fact, the result of employees providing their company e-mail addresses, which are being improperly used by the site owners. Step 3: Develop Possible Solutions locates the source of the spam e-mails, they can speak with the e-mail server and firewall admin and then turn to her Certified Information Systems Security Professional (CISSP) reading list…. Step 4: Analyze and Compare Possible Solutions They eliminate any overly expensive solutions,..three alternatives: (1) do nothing, accepting the spam as a cost of doing business, (2) have the e-mail administrator change the users' accounts, or (3) have the firewall administrator filter access to and traffic from the spam sites. Solving Problems Step 5: Select, Implement, and Evaluate if it proves ineffective, it can be canceled or altered quickly. They might also decide to require the affected employees to attend an e-mail security policy training program, where they can be reminded of the importance of controlling when and where they release company e-mail addresses. Principles of Information Security Management InfoSec management team is focused on the secure operation of the organization. Include the following characteristics that will be the focus of the current course (six P’s): 1. Planning 2. Policy 3. Programs 4. Protection 5. People 6. Project Management Planning Planning as part of InfoSec management – An extension of the basic planning model discussed earlier in this chapter Included in the InfoSec planning model – Activities necessary to support the design, creation, and implementation of information security strategies Planning (cont’d.) Types of InfoSec plans – Incident response planning – Business continuity planning – Disaster recovery planning – Policy planning – Personnel planning – Technology rollout planning – Risk management planning – Security program planning includes education, training and awareness Policy The set of organizational guidelines that dictates certain behavior within the organization Three general categories of policy: – Enterprise information security policy (EISP) – Issue-specific security policy (ISSP) – System-specific policies (SysSPs) TVTC Policies Programs InfoSec operations that are specifically managed as separate entities – Example: a security education training and awareness (SETA) program Other types of programs – Physical security program complete with fire, physical access, gates, guards, etc. Protection Executed through risk management activities – Includes: – Risk assessment and control – Protection mechanisms – Technologies – Tools Each of these mechanisms represents some aspect of the management of specific controls in the overall information security plan People Managers must recognize the crucial role that people play in the information security program This area of InfoSec includes security personnel and the security of personnel, as well as aspects of a SETA program The most critical link in the information security program Project Management Identifying and controlling the resources applied to the project Measuring progress Adjusting the process as progress is made Whether an InfoSec manager is asked to roll out a new security training program or select and implement a new firewall, it is important that the process be managed as a project. The final element for thoroughgoing InfoSec management is the application of a project management discipline to all elements of the InfoSec program. Project management involves identifying and controlling the resources applied to the project, as well as measuring progress and adjusting the process as progress is made toward the goal. Chapter 5 explores project management in more detail. Summary What is security? Principles of information security management – Planning – Policy – Programs – Protection – People – Project management