Security Mgt U2, summary

information security
1. business issue
  1. has own budget
  2. has own personnel
  3. management must drive decisions
  4. business dependent on IT systems
2. modern boundaries blurred
3. gone from IT issue to consumer issue
  1. due to ecommerce
4. confidentiality, integrity, availabiltiy
  1. integrity & availability most important
5. resource decentralization
6. protect information NOT hardware
7. protect the business
  1. sensible controls
  2. usable controls
8. information theft
  1. you may not notice it
  2. not audit trail
  3. lucky if there are logs
9. information risk mgt
  1. identify threats
  2. identifiy likelihood
  3. identify impacts
    1. what is data loss worth?
      1. company reputation
      2. leaked business info, competitive edge
  4. identify vulnerabilities
  5. governance
    1. policy
    2. procedure
10. adequate (not perfect) protection
  1. people
  2. financial
  3. information
  4. infrastructure
risk assessment
1. 3 components
  1. threats
    1. unwanted event that may result in harm to an asset
  2. vulnerability
    1. susceptability of asset to attack
  3. impact
    1. magnitude of potential loss
2. CRAM
  1. tool / software / methodology
    1. prompts with threats
    2. facilitates documentation
3. anecdotal examples/ comments
  1. attack sophistication has increased
    1. even though attackers have little technical knowledge
  2. security costs money
  3. identity theft
  4. phishing / pharming
  5. spoof websites
  6. social engineering
  7. DDOS
    1. more effective against small companies
    2. attacks getting bigger
    3. use rapid filtering to manage
    4. usually attacks at IP level
      1. point DNS to new IP
        expensive
    5. business is reliant on open network
governance
1. means by which companies are directed and controlled
2. accountability of board
  1. ethical
  2. legal
  3. performance
3. needs to demonstrate compliance with rules, regulations and law
  1. FSA
  2. FED
  3. SOX
  4. BASLE II
  5. ISO 17799
  6. COBIT
  7. ITIL
4. of info sec
  1. means by which infosec is controlled and directed in company
  2. administered by top level steering committee
  3. CISO provides assurance to board and regulators
    1. compliance (checking)
    2. audit testing
    3. board level issue
5. specifyimg mode of operaion
  1. policy
    1. what you want to do (but not how you do it)
    2. outlines responsibilities
    3. outliens partner and supplier responsibilities
    4. should be endorsed at all management levels
    5. identify owners of systems
      1. infrastructure (generally IT)
      2. applictaions
      3. processes (end-to-end
  2. standards
    1. specification of how we do it
  3. guidelines
    1. good practice but not required
  4. procedures
    1. specify behavior for end-to-end processes
      1. instalation
      2. operation
      3. initialisation
      4. support

Next up

Security Mgt U2, summary

Description

Resource summary

Similar

	Created by jjanesko about 11 years ago