Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 247 views

    Merkow PPT 02-jrm

    Uploaded by

    carray de silva
    The document discusses 12 principles of information security including that absolute security is not possible, the goals of confidentiality, integrity and availability, using defense in depth as a security strategy, that people tend to make poor security decisions without guidance, and that security is achieved through risk management rather than eliminating all threats.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Merkow PPT 02-jrm

    Uploaded by

    carray de silva
    247 views17 pages
    The document discusses 12 principles of information security including that absolute security is not possible, the goals of confidentiality, integrity and availability, using defense in depth as a security strategy, that people tend to make poor security decisions without guidance, and that security is achieved through risk management rather than eliminating all threats.

    Original Description:

    information security

    Original Title

    merkow_ppt_02-jrm

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses 12 principles of information security including that absolute security is not possible, the goals of confidentiality, integrity and availability, using defense in depth as a security strategy, that people tend to make poor security decisions without guidance, and that security is achieved through risk management rather than eliminating all threats.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    247 views17 pages

    Merkow PPT 02-jrm

    Uploaded by

    carray de silva
    The document discusses 12 principles of information security including that absolute security is not possible, the goals of confidentiality, integrity and availability, using defense in depth as a security strategy, that people tend to make poor security decisions without guidance, and that security is achieved through risk management rather than eliminating all threats.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 17

    Information Security

    Principles and Practices

    by Mark Merkow and Jim Breithaupt

    Chapter 2: Information Security Principles of Success


    Introduction
    Imperative to rely on principle-based
    analysis and decision making
    No two systems or situations are identical, and
    there are no cookbooks to consult on how to solve
    security problems
    Information Security Principles:
    #1 There Is No Such Thing as Absolute Security

    Given enough time, tools, skills, and


    inclination, a hacker can break through any
    security measure
    Pearson Education Information Security:
    Principles and Practices 2
    Information Security Principles:
    #2 Three Security Goals (CIA triad)

    Protect the confidentiality of data


    Confidentiality models are primarily intended to
    assure that no unauthorized access to information
    is permitted and that accidental disclosure of
    sensitive information is not possible

    Pearson Education Information Security:


    Principles and Practices 3
    Information Security Principles:
    #2 Three Security Goals cont.
    Preserve the integrity of data
    Integrity models keep data pure and
    trustworthy by protecting system data from
    intentional and accidental changes
    Promote the availability of data for
    authorized use
    Availability models keep data and
    resources available for authorized use

    Pearson Education Information Security:


    Principles and Practices 4
    Information Security Principles:
    #3 Defense in Depth as Strategy

    Defense in depth
    Security implemented in overlapping layers
    that provide the three elements needed to
    secure assets: prevention, detection, and
    response
    The weaknesses of one security layer are
    offset by the strengths of two or more
    layers
    Pearson Education Information Security:
    Principles and Practices 5
    Information Security Principles:
    #4 When Left on Their Own, People Tend to
    Make the Worst Security Decisions
    Takes little to convince someone to give
    up their credentials in exchange for trivial
    or worthless goods
    Many people are easily convinced to
    double-click on the attachment
    Subject: Here you have, ;o)
    Message body: Hi: Check This!
    Attachment: AnnaKournikova.jpg.vbs

    Pearson Education Information Security:


    Principles and Practices 6
    Information Security Principles:
    #5 Functional and Assurance Requirements
    Functional requirements
    Describe what a system should do
    Assurance requirements
    Describe how functional requirements should be
    implemented and tested

    Does the system do the right things in the right way?


    Verification: the process of confirming that one or

    more predetermined requirements or specifications are


    met
    Validation: a determination of the correctness or

    quality of the mechanisms used in meeting the needs


    Pearson Education Information Security:
    Principles and Practices 7
    Information Security Principles:
    #6 Security Through Obscurity Not an Answer

    Many people believe that if hackers dont


    know how software is secured, security is
    better
    Although this seems logical, its actually
    untrue
    Obscuring security leads to a false sense
    of security, which is often more
    dangerous than not addressing security
    at all
    Pearson Education Information Security:
    Principles and Practices 8
    Information Security Principles:
    #7 Security = Risk Management
    Security is not concerned with eliminating all
    threats within a system or facility but with
    eliminating known threats and minimizing losses
    if an attacker succeeds in exploiting a
    vulnerability
    Risk analysis and risk management are central
    themes to securing information systems
    Risk assessment and risk analysis are
    concerned with placing an economic value on
    assets to best determine appropriate
    countermeasures that protect them from losses
    Pearson Education Information Security:
    Principles and Practices 9
    Information Security Principles:
    #7 Security = Risk Management cont.

    Vulnerability
    A known problem within a system or program
    Exploit
    A program or a cookbook on how to take
    advantage of a specific vulnerability
    Attacker
    The link between a vulnerability and an exploit

    Pearson Education Information Security:


    Principles and Practices 10
    Information Security Principles:
    #7 Security = Risk Management cont.

    Pearson Education Information Security:


    Principles and Practices 11
    Information Security Principles:
    #8 Security Controls: Preventative,
    Detective, and Responsive
    A security mechanism serves a purpose
    by preventing a compromise, detecting
    that a compromise or compromise
    attempt is underway, or responding to a
    compromise while it is happening or
    after it has been discovered
    Pearson Education Information Security:
    Principles and Practices 12
    Information Security Principles:
    #9 Complexity Is The Enemy of Security

    The more complex a system gets, the


    harder it is to secure

    Pearson Education Information Security:


    Principles and Practices 13
    Information Security Principles:
    #10 Fear, Uncertainty, and Doubt (FUD) Do
    Not Work in Selling Security
    Information security managers must
    justify all investments in security using
    techniques of the trade

    When spending resources can be justified


    with good, solid business rationale,
    security requests are rarely denied
    Pearson Education Information Security:
    Principles and Practices 14
    Information Security Principles:
    #11 People, Process and Technology
    Are All Needed
    People, process, and technology controls
    are essential elements of security
    practices including
    operations security,
    applications
    development security,
    physical security,
    and cryptography
    Pearson Education Information Security:
    Principles and Practices 15
    Information Security Principles:
    #12 Open Disclosure of Vulnerabilities
    Is Good for Security
    Keeping a given vulnerability secret from
    users and from the software developer
    can only lead to a false sense of security

    The need to know trumps the need to


    keep secrets in order to give users the
    right to protect themselves
    Pearson Education Information Security:
    Principles and Practices 16
    Summary

    Computer security specialists must not


    only know the technical side of their jobs
    but also must understand the principles
    behind information security
    These principles are mixed and matched
    to describe why certain security functions
    and operations exist in the real world of IT

    Pearson Education Information Security:


    Principles and Practices 17

    You might also like