Ch1Introduction

INFORMATION SECURITY
MANAGEMENT
MIS534
Course Outline – Topics Covered
 Planning for Security and

Contingencies
 Information Security Policy
 Developing Security Programs
 Security Management Models
 Risk Management
• Identifying
• Assessing
• Controlling
Course Outline – Topics Covered
 Protection Mechanism
 Personnel and Security
 Law and Ethics
 Security and the Cloud
Classroom Procedures
Most classes will contain the following components:

 Current Events
 Lectures
 Case Studies
 Term Paper Presentations
Encourage student sharing their experiences

Course Structure:
Assessments (3) 40%
Case Study/Exercises/Current Events 15%
Term paper 20%
Demo/Hands-on Lab Project 15%
Class Participation/Discussions 10%

Current Topics / Threat Predictions
The primary purpose of this assignment is to bring in

current topics that are occurring in the world of
information security.
Choose 1 threat prediction for 2016 to research and

present during one of the sessions.
See threat predictions link on calendar and pick 3

possible topics to research and present on. These will
be assigned next week to be presented throughout
the semester.
Term Paper
The primary purpose of this assignment is to provide

you an opportunity to further develop practical research
skills by investigating an information security and
information assurance (IA) related topic (hopefully of
personal interest).
Consists of:
Executive summary of the topic (~ 1500 words)
 include an annotated bibliography (with at least 8
references)
15-20 minutes presentation of your executive summary
to class.
Hands On/Lab Presentation
Prepare a presentation (5-7 minutes) and a live

demonstration or hands-on lab exercise (20-25
minutes) on a security related technology.
Consists of:
Student Handout
Class Presentation
Live Demonstration
Annotated Bibliography of useful resources
Class Introductions/Expectations
Name
Background
Course Expectations
Who I am
Dr. Cummings
Assistant Professor at UNCW
 Ph.D. in IS (Indiana University)
 MBA in IS (Texas Tech University)
 Industry experience in networking, programming, project
management.
Introduction to Information Security
Management
Do not figure on opponents not attacking;

worry about your own lack of preparation.
BOOK OF THE FIVE RINGS

Information Security Management
You can have all the protection mechanisms in

place and still have security problems:
http://www.twincities.com/business/ci_24887125/target-
breach-likely-an-inside-job-data-security
http://www.computerweekly.com/news/2240212475/Tar
get-to-invest-5m-in-cyber-security-awareness
http://fortune.com/2014/12/30/new-research-sony-hack/
http://www.techrepublic.com/article/why-the-sony-hack-
shouldnt-lead-to-the-end-of-user-centric-it/
http://www.businessweek.com/articles/2014-11-06/home-depot-
hackers-got-in-via-a-vendor-took-53-million-e-mails-too
Technology is not enough…..
(From: PWC Global State of Information Security 2015)
Even the best technological solutions are being

constantly worked on to circumvent.
Essential governance and operational processes:

•Incident management response process
•Classifying business value of data
•Risk assessments on internal systems
•Security Audits
•Governance, risk and compliance
(From: PWC Global State of Information Security 2014)
The goal of this course is to take a step back and

examine how security functions as a whole within the
organization.
Challenge:
Everything cannot be categorized as right or wrong
What works for one company may fail in another

Careers in Information Security
Most studies/reports point to a shortage of security
professionals over the next 5 years.
A Cisco 2014 Annual Security Report:

• 500,000 global cybersecurity shortfall
• 30,000 domestically
CompTIA Security+
Entry-level certification
Requires 2 years experience working in network

security
Credential holders possess expertise in knowledge

areas such as
• Cryptography
• Identity management
• Security systems
• Security risk identification and mitigations
• Network access control
Certified Information Systems Security
Professional
 Five years of experience in information security

 There are 250 multiple-choice questions
 Exam duration: six hours
Other Certifications
Systems Security Certified Practitioner

 Only one year of experience required
 Test is 90 minutes long, 50-70 questions
Certified Ethical Hacker
Certified Information Security Manager

Early forms of Information Security
Figure 1-1 The Enigma Source: Courtesy of National Security Agency

The 1990s
Networks of computers became more common; so

too did the need to interconnect networks
Internet became first manifestation of a global
network of networks
In early Internet deployments, security was treated
as a low priority
2000 to Present
The Internet brings millions of computer networks

into communication with each other—many of
them unsecured
Ability to secure a computer’s data influenced by the

security of every computer to which it is
connected
Growing threat of cyber attacks has increased the

need for improved security
Introduction
The concept of computer security has become

synonymous with the concept of information
security
Information security is no longer the sole

responsibility of a discrete group of people
in the company
Information Security Decision Makers
1) Information security mgr and professionals

(InfoSec Community)
2) Information technology mgr and professionals

(Information Technology Community)
3) Non-technical business mgr and professionals

(General Business Community)
What Is Security?
• How do you define security?
• Specialized areas of security

• Physical
• Operations
• Communications
• Network
Each of these areas contribute to the

information security program as a whole
What Is Information Security?
What is Information Security?
How do we achieve Information

Security?
Policy
Technology
Training and Awareness Programs
Role of information security is to protect an
organization’s information assets
Components of an Information
System
Information system (IS) is entire set of components
necessary to use information as a resource in the
organization
 Software
 Hardware
 Data
 People
 Procedures
 Networks
28
Key Information Security Concepts
 Access  Protection Profile or

 Asset Security Posture
 Attack  Risk
 Control, Safeguard,  Subjects and Objects
or Countermeasure  Threat
 Exploit
 Threat Agent
 Exposure
 Vulnerability
 Loss
29
Figure 1-1 Components of Information security
http://www.cnss.gov/policies.html
Source: Course Technology/Cengage Learning
CNSS Security Model (cont’d.)
 C.I.A. triangle
– Confidentiality, integrity, and availability
– Has expanded into a more comprehensive list of
critical characteristics of information
 NSTISSI (CNSS) Security Model

– Provides a more detailed perspective on security
– Covers the three dimensions of information security
– Primary purpose: identify gaps in the coverage of an
information security program
CNSS Security Model (cont’d.)
 NSTISSC Security Model (cont’d.)

– Must address all 27 cells when designing/reviewing a
program
Main Purpose: identify gaps in an information security program

How to measure the value of information - CIA
Triangle
The value of information comes from the

characteristics it possesses
Exp
a nd
incl ed to
ud e Identification
Authentication
Authorization
Privacy
Accountability
Confidentiality
The characteristic of information whereby only those

with sufficient privileges may access certain
information
Measures used to protect confidentiality:

– Information classification
– Secure document storage
– Application of general security policies
– Education of information custodians and end users
Integrity
The quality or state of being whole, complete,

and uncorrupted
Threats to information integrity:

– Corruption
– Damage
– Destruction
– Other disruption of its authentic state
Availability
The characteristic of information that enables user

access to information in a required format, without
interference or obstruction
Availability does not imply that the information is

accessible to any user (Implies availability to
authorized users)
Identification and
Authentication
Identification
– An information system possesses the characteristic of
identification when it is able to recognize individual users
– Identification and authentication are essential to
establishing the level of access or authorization that an
individual is granted
Authentication
– Occurs when a control proves that a user possesses the
identity that he or she claims
Authorization
Assures that the user has been specifically and
explicitly authorized by the proper authority to
access, update, or delete the contents of an
information asset
Authorization occurs after authentication

Privacy
Information collected, used, and stored by an

organization is to be used only for the purposes
stated to the data owner at the time it was collected
Privacy as a characteristic of information does not

signify freedom from observation
 Means that information will be used only in ways known
to the person providing it
Accountability
Exists when a control provides assurance that every

activity undertaken can be attributed to a named
person or automated process
Balancing Information Security and
Access
Should everyone have an access button?
Should information be kept in a

vault?
Access
Security
Functionality Usability
Access
Impossible to obtain perfect security—it is a
process, not an absolute
Security should be considered balance between

protection and availability
Security as Art
No hard and fast rules nor many universally accepted

complete solutions
No manual for implementing security through entire

system
Security as Science
Dealing with technology designed to operate at high

levels of performance
Specific conditions cause virtually all actions that

occur in computer systems
Nearly every fault, security hole, and systems

malfunction are a result of interaction of specific
hardware and software
If developers had sufficient time, they could resolve

and eliminate faults
Principles of Information Security
Management
Include the following characteristics that will be the

focus of the current course (six P’s):
1. Planning
2. Policy
3. Programs
4. Protection
5. People
6. Project Management
http://csrc.nist.gov/publications/PubsTC.html
Planning
• Planning as part of InfoSec management

– An extension of the basic planning model discussed
earlier in this chapter
• Included in the InfoSec planning model

– Activities necessary to support the design, creation, and
implementation of information security strategies
Planning (cont’d.)
• Types of InfoSec plans

– Incident response planning
– Business continuity planning
– Disaster recovery planning
– Policy planning
– Personnel planning
– Technology rollout planning
– Risk management planning
– Security program planning
• includes education, training and awareness
Policy
• The set of organizational guidelines that dictates

certain behavior within the organization
• Three general categories of policy:

– Enterprise information security policy (EISP)
– Issue-specific security policy (ISSP)
– System-specific policies (SysSPs)
UNCW Policies
Programs
• InfoSec operations that are specifically managed

as separate entities
– Example: a security education training and awareness
(SETA) program
• Other types of programs

– Physical security program
• complete with fire, physical access, gates, guards, etc.
Protection
• Executed through risk management activities

– Includes:
– Risk assessment and control
– Protection mechanisms
– Technologies
– Tools
• Each of these mechanisms represents some

aspect of the management of specific controls in
the overall information security plan
People
Managers must recognize the crucial role that

people play in the information security program
This area of InfoSec includes security personnel and

the security of personnel, as well as aspects of a
SETA program
The most critical link in the information

security program
Project Management
Identifying and controlling the resources applied to

the project
Measuring progress
Adjusting the process as progress is made

Summary
• What is security?
• Principles of information security management
– Planning
– Policy
– Programs
– Protection
– People
– Project management
Next Class
• Chapter 2 – Planning for Security
• Signup for Entropy

• Lecture Slides and additional readings will be posted in the
calendar
• Teams and Threat Prediction Selections
• I will cover discussion of cases and current events

next week but read them before class!

Ch1Introduction

Uploaded by

Copyright:

Available Formats

Ch1Introduction

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ch1Introduction

Uploaded by

Copyright:

Available Formats

INFORMATION SECURITY

 Planning for Security and

Most classes will contain the following components:

Encourage student sharing their experiences

Assessments (3) 40%

Case Study/Exercises/Current Events 15%

Term paper 20%

Demo/Hands-on Lab Project 15%

Class Participation/Discussions 10%

The primary purpose of this assignment is to bring in

Choose 1 threat prediction for 2016 to research and

See threat predictions link on calendar and pick 3

The primary purpose of this assignment is to provide

Prepare a presentation (5-7 minutes) and a live

Do not figure on opponents not attacking;

BOOK OF THE FIVE RINGS

You can have all the protection mechanisms in

Even the best technological solutions are being

Essential governance and operational processes:

The goal of this course is to take a step back and

What works for one company may fail in another

A Cisco 2014 Annual Security Report:

Requires 2 years experience working in network

Credential holders possess expertise in knowledge

 Five years of experience in information security

Systems Security Certified Practitioner

Certified Ethical Hacker

Certified Information Security Manager

Figure 1-1 The Enigma Source: Courtesy of National Security Agency

Networks of computers became more common; so

The Internet brings millions of computer networks

Ability to secure a computer’s data influenced by the

Growing threat of cyber attacks has increased the

The concept of computer security has become

Information security is no longer the sole

1) Information security mgr and professionals

2) Information technology mgr and professionals

3) Non-technical business mgr and professionals

• How do you define security?

• Specialized areas of security

Each of these areas contribute to the

What is Information Security?

How do we achieve Information

 Access  Protection Profile or

 NSTISSI (CNSS) Security Model

 NSTISSC Security Model (cont’d.)

Main Purpose: identify gaps in an information security program

The value of information comes from the

The characteristic of information whereby only those

Measures used to protect confidentiality:

The quality or state of being whole, complete,

Threats to information integrity:

The characteristic of information that enables user

Availability does not imply that the information is

Authorization occurs after authentication

Information collected, used, and stored by an

Privacy as a characteristic of information does not

Exists when a control provides assurance that every

Should everyone have an access button?

Should information be kept in a