Principles of Information Security,
Fourth Edition
Chapter 1
Information Security: An Introduction
Learning Objectives
• Upon completion of this material, you should be
able to:
– Define information security
– Recount the history of computer security and how it
evolved into information security
– Define key terms and critical concepts of information
security
– Enumerate the phases of the security systems
development life cycle
– Describe the information security roles of
professionals within an organization
Principles of Information Security, Fourth Edition
2
Do not figure on opponents not attacking; worry about
your own lack of preparation.
Book of Five Rings
Principles of Information Security, Fourth Edition
3
What is Security?
• “The quality or state of being secure—to be free
from danger”
• A successful organization should have multiple
layers of security in place:
–
–
–
–
–
–
Physical security
Personal security
Operations security
Communications security
Network security
Information security
Principles of Information Security, Fourth Edition
4
What is Security? (cont’d.)
• What is Information security?
• The protection of information and its critical
elements, including systems and hardware that
use, store, and transmit that information
• Necessary tools(How?): policy, awareness,
training, education, technology
• C.I.A. triangle
– Was standard based on confidentiality,
integrity, and availability
Principles of Information Security, Fourth Edition
5
What is Security? (cont’d.)
Key Information Security Concepts
•
•
•
•
Access
Asset
Attack
Control, Safeguard, or
Countermeasure
• Exploit
• Exposure
• Loss
Principles of Information Security, Fourth Edition
• Protection Profile or
Security Posture
• Risk
• Subjects and Objects
• Threat
• Threat Agent
• Vulnerability
7
Access - a subject or object’s ability to use, manipulate, modify,
or affect another subject or object.
Asset - the organizational resource that is being protected.
Attack - an act that is an intentional or unintentional attempt to
cause damage or compromise to the information and/or the systems
that support it.
.
Principals of Information Security, Fourth Edition
8
Control, Safeguard, or Countermeasure - security mechanisms,
policies, or procedures that can successfully counter attacks, reduce
risk, resolve vulnerabilities, and otherwise improve the security within
an organization
Object - a passive entity in the information system that receives or
contains information.
Subject - an active entity that interacts with an information system
and causes information to move through the system for a specific end
purpose
Principals of Information Security, Fourth Edition
9
Exploit - to take advantage of weaknesses or vulnerability
in a system.
Exposure - a single instance of being open to damage.
Hack - Good: to use computers or systems for enjoyment;
Bad: to illegally gain access to a computer or system.
. Security Posture or Security Profile - a general label for
the combination of all policies, procedures, technologies,
and programs that make up the total security effort
currently in place.
Principals of Information Security, Fourth Edition
10
Risk - the possibility that something can happen.
Security Blueprint - the plan for the implementation of
new security measures in the organization.
Security Model - a collection of specific security rules
that represents the implementation of a security policy.
Principals of Information Security, Fourth Edition
11
Threats - a category of objects, persons, or other entities that
represents a potential danger to an asset.
Threat Agent - a specific instance or component of a more general
threat.
Vulnerability - weaknesses or faults in a system or protection
mechanism that expose information to attack or damage
Principals of Information Security, Fourth Edition
12
Principles of Information Security, Fourth Edition
13
Figure 1-5 – Subject and Object of
Attack
Figure 1-5 Computer as the Subject and Object of an Attack
Principles of Information Security, Fourth Edition
14
Critical Characteristics of Information
• The value of information comes from the
characteristics it possesses:
–
–
–
–
–
–
–
Availability
Accuracy
Authenticity
Confidentiality
Integrity
Utility
Possession
Principles of Information Security, Fourth Edition
15
Availability – Enables users who need to access information to do so
without interference or obstruction and in the required format.
The information is said to be available to an authorized user when and
where needed and in the correct format.
Accuracy – Free from mistake or error and having the value that the end
user expects.
If information contains a value different from the user’s expectations due to
the intentional or unintentional modification of its content, it is no longer
accurate.
.
Principals of Information Security, Fourth Edition
16
Authenticity –The quality or state of being genuine
or original, rather than a reproduction or fabrication.
Information is authentic when it is the information that
was originally created, placed, stored, or transferred
Confidentiality – The quality or state of preventing
disclosure or exposure to unauthorized individuals
or systems.
Principals of Information Security, Fourth Edition
17
Integrity – The quality or state of being whole, complete, and
uncorrupted.
The integrity of information is threatened when the information is
exposed to corruption, damage, destruction, or other disruption of
its authentic state.
Utility – The quality or state of having value for some purpose or
end.
Information has value when it serves a particular purpose.
This means that if information is available, but not in a format
meaningful to the end user, it is not useful.
Principals of Information Security, Fourth Edition
18
Possession – The quality or state of having ownership or control
of some object or item.
Information is said to be in possession if one obtains it, independent
of format or other characteristic.
While a breach of confidentiality always results in a breach of
possession, a breach of possession does not always result in a
breach of confidentiality.
Principals of Information Security, Fourth Edition
19
CNSS Security Model
Figure 1-6 The McCumber Cube
Principles of Information Security, Fourth Edition
20
Components of an Information System
• Information system (IS) is entire set of components
necessary to use information as a resource in the
organization
–
–
–
–
–
–
Software
Hardware
Data
People
Procedures
Networks
Principles of Information Security, Fourth Edition
21
Balancing Information Security and
Access
• Impossible to obtain perfect security—it is a
process, not an absolute
• Security should be considered balance between
protection and availability
• To achieve balance, level of security must allow
reasonable access, yet protect against threats
Principles of Information Security, Fourth Edition
22
Figure 1-6 – Balancing Security and
Access
Figure 1-8 Balancing Information Security and Access
Principles of Information Security, Fourth Edition
23
Approaches to Information Security
Implementation
• Bottom-Up :
–
–
–
–
Establishing security policies that begins as a grassroots effort
Administrators attempt to improve security
Advantage: technical expertise of administrators
Disadvantages: seldom works, lacks participant support, Organizations
may not stay in power
• Top-Down:
–
–
–
–
–
–
Initiated by upper management
Issue policy, procedures, and processes
Dictate goals and expected outcomes of project
Determine accountability for each required action
The most successful
Involves formal systems development life cycle
24
Figure 1-9 Approaches to Information Security Implementation
Principles of Information Security, Fourth Edition
25
The Systems Development Life Cycle
• Systems Development Life Cycle (SDLC): methodology for
design and implementation of information system within an
organization
• Methodology: formal approach to problem solving based on
structured sequence of procedures
• SecSDLC: Identifying threats and creating controls to counter them.
• Using this methodology:
– Ensures a rigorous process
– Avoid missing steps
– a coherent program rather than a series of random actions
– Increases probability of success
Principles of Information Security, Fourth Edition
26
Traditional SDLC consists of six general phases
Figure 1-10 SDLC Waterfall Methodology
Principles of Information Security, Fourth Edition
27
Investigation
• What problem will the system solve?
• Objectives, processes, outcomes, constraints, and
scope of project are specified
• Preliminary cost-benefit analysis is developed
• Begins with Enterprise Information Security Policy
• At the end, feasibility analysis is performed to
assess economic, technical, and behavioural
feasibilities of the process
Principles of Information Security, Fourth Edition
28
Analysis
• Consists of assessments of:
– The organization analysis
– Current systems analysis
– Capability and resources to support proposed systems
• Starts: analysts determine what new system is expected to
do and how it will interact with existing systems.
• Analysis of existing security policies or programs, current
threats and associated controls
• Includes analysis of relevant legal issues
• Ends: its findings is used to update feasibility analysis
Principles of Information Security, Fourth Edition
29
Logical Design
• Main factor is business needs
– Information gained from analysis phase to create solution.
• Based on the business need, select applications capable of providing
needed services.
• Based on the applications needed, select data support and structures
capable of providing the needed inputs.
• Finally, based on above, we can determine solutions for physical
security
• Creates and develops blueprints for information security
• Incident response actions planned:
– Continuity planning
– Incident response
– Disaster recovery
30
• A final feasibility study: Will do the project or outsource it?
Physical Design
• Technologies to support the alternatives identified
and evaluated in the logical design are selected
• Alternatives evaluated on make-or-buy decision
• Feasibility study determines readiness of
organization for project
• Entire solution presented to end-user for approval
Principles of Information Security, Fourth Edition
31
Implementation
• Any needed software is created or purchased.
• Security solutions acquired, tested, implemented, and
tested again. All system components tested individually,
and then tested as a system.
• Users are trained and supporting documentation is
created.
Principles of Information Security, Fourth Edition
32
Maintenance and Change
• Longest, most important and most expensive phase
• a new project and life cycle will begin if the old one is
outdated
• Improving the system, repairing damage and adopting
with emerging threats and changing environment:
• Upgrades, updates, and patches are managed.
• When a current system can no longer support the
mission of the organization, the project is terminated and
a new project is implemented.
Principles of Information Security, Fourth Edition
33
Security Professionals: Senior
Management
• Chief Information Officer (CIO)
– Senior technology officer
– Primarily responsible for advising senior executives
on strategic planning
• Chief Information Security Officer (CISO)
– Primarily responsible for assessment, management,
and implementation of IS in the organization
– Usually reports directly to the CIO
Principles of Information Security, Fourth Edition
34
Security Professionals: Project Team
• A number of individuals who are experienced in
one or more facets of required technical and
nontechnical areas:
–
–
–
–
–
–
–
Champion
Team leader
Security policy developers
Risk assessment specialists
Security professionals
Systems administrators
End users
Principles of Information Security, Fourth Edition
35
Data Responsibilities
• Data owner: responsible for the security and use of
a particular set of information
• Data custodian: responsible for storage,
maintenance, and protection of information
• Data users: end users who work with information to
perform their daily jobs supporting the mission of
the organization
Principles of Information Security, Fourth Edition
36
Nature of Security
• Implementation of information security often described as
combination of art, social, and science
• Artful aspects: specialists have different perceptions
about technology, no hard and fast rules, no single
manual for implementation
• Scientific aspects: faults, security hole, and malfunction
are a result of specific hardware and software issues
• Social aspects: Security begins and ends with the
people that interact with the system.
Principles of Information Security, Fourth Edition
37
Summary
• Information security is a “well-informed sense of
assurance that the information risks and controls
are in balance”
• Computer security began immediately after first
mainframes were developed
• Successful organizations have multiple layers of
security in place: physical, personal, operations,
communications, network, and information
Principles of Information Security, Fourth Edition
38
Summary (cont’d.)
• Security should be considered a balance between
protection and availability
• Information security must be managed similarly to
any major system implemented in an organization
using a methodology like SecSDLC
• Implementation of information security often
described as a combination of art and science
Principles of Information Security, Fourth Edition
39