Learning Objectives

Upon completion of this material, you should be able to: Define information security Relate the history of computer security and how it evolved into information security Define key terms and critical concepts of information security as presented in this chapter Present the roles of professionals involved in information security within an organization

Principles of Information Security, 3rd Edition

Introduction
Information security: a well-informed sense of assurance that the information risks and controls are in balance. Jim Anderson, Inovant (2002) Necessary to review the origins of this field and its impact on our understanding of information security today

Principles of Information Security, 3rd Edition

The History of Information Security

Began immediately after the first mainframes were developed

Groups developing code-breaking computations during World War II created the first modern computers Physical controls to limit access to sensitive military locations to authorized personnel Rudimentary in defending against physical theft, espionage, and sabotage
Principles of Information Security, 3rd Edition 4

The 1960s
Advanced Research Project Agency (ARPA) began to examine feasibility of redundant networked communications Larry Roberts developed ARPANET from its inception

Principles of Information Security, 3rd Edition

Figure 1-2 - ARPANET

Principles of Information Security, 3rd Edition

The 1970s and 80s

ARPANET grew in popularity as did its potential for misuse Fundamental problems with ARPANET security were identified
No safety procedures for dial-up connections to ARPANET

Nonexistent user identification and authorization to system

Late 1970s: microprocessor expanded computing capabilities and security threats

Principles of Information Security, 3rd Edition

The 1970s and 80s (continued)

Information security began with Rand Report R-609 (paper that started the study of computer security)

Scope of computer security grew from physical security to include:

Safety of data
Limiting unauthorized access to data Involvement of personnel from multiple levels of an organization

Principles of Information Security, 3rd Edition

MULTICS
Early focus of computer security research was a system called Multiplexed Information and Computing Service (MULTICS) First operating system created with security as its primary goal Mainframe, time-sharing OS developed in mid-1960s by General Electric (GE), Bell Labs, and Massachusetts Institute of Technology (MIT) Several MULTICS key players created UNIX Primary purpose of UNIX was text processing
Principles of Information Security, 3rd Edition 9

The 1990s
Networks of computers became more common; so too did the need to interconnect networks

Internet became first manifestation of a global network of networks In early Internet deployments, security was treated as a low priority

Principles of Information Security, 3rd Edition

10

The Present
The Internet brings millions of computer networks into communication with each othermany of them unsecured Ability to secure a computers data influenced by the security of every computer to which it is connected

Principles of Information Security, 3rd Edition

11

What is Security?
The quality or state of being secureto be free from danger A successful organization should have multiple layers of security in place:
Physical security Personal security Operations security Communications security Network security Information security
12

Principles of Information Security, 3rd Edition

What is Security? (continued)

The protection of information and its critical elements, including systems and hardware that use, store, and transmit that information Necessary tools: policy, awareness, training, education, technology C.I.A. triangle was standard based on confidentiality, integrity, and availability

C.I.A. triangle now expanded into list of critical characteristics of information

Principles of Information Security, 3rd Edition 13

Principles of Information Security, 3rd Edition

14

Critical Characteristics of Information

The value of information comes from the characteristics it possesses:
Availability
Accuracy

Authenticity
Confidentiality Integrity

Utility
Possession
Principles of Information Security, 3rd Edition 15

Components of an Information System

Information system (IS) is entire set of software, hardware, data, people, procedures, and networks necessary to use information as a resource in the organization

Principles of Information Security, 3rd Edition

16

Securing Components
Computer can be subject of an attack and/or the object of an attack
When the subject of an attack, computer is used as an active tool to conduct attack When the object of an attack, computer is the entity being attacked

Principles of Information Security, 3rd Edition

17

Figure 1-5 Subject and Object of Attack

Principles of Information Security, 3rd Edition

18

Balancing Information Security and Access

Impossible to obtain perfect securityit is a process, not an absolute

Security should be considered balance between protection and availability To achieve balance, level of security must allow reasonable access, yet protect against threats

Principles of Information Security, 3rd Edition

19

Figure 1-6 Balancing Security and Access

Principles of Information Security, 3rd Edition

20

Approaches to Information Security Implementation: Bottom-Up Approach

Grassroots effort: systems administrators attempt to improve security of their systems

Key advantage: technical expertise of individual administrators Seldom works, as it lacks a number of critical features:
Participant support Organizational staying power
Principles of Information Security, 3rd Edition 21

Approaches to Information Security Implementation: Top-Down Approach

Initiated by upper management
Issue policy, procedures, and processes
Dictate goals and expected outcomes of project

Determine accountability for each required action

The most successful also involve formal development strategy referred to as systems development life cycle

Principles of Information Security, 3rd Edition

22

Principles of Information Security, 3rd Edition

23

Security Professionals and the Organization

Wide range of professionals required to support a diverse information security program

Senior management is key component; also, additional administrative support and technical expertise are required to implement details of IS program

Principles of Information Security, 3rd Edition

24

Senior Management
Chief Information Officer (CIO) Senior technology officer Primarily responsible for advising senior executives on strategic planning

Chief Information Security Officer (CISO)

Primarily responsible for assessment, management, and implementation of IS in the organization Usually reports directly to the CIO
Principles of Information Security, 3rd Edition 25

Information Security Project Team

A number of individuals who are experienced in one or more facets of required technical and nontechnical areas:
Champion
Team leader

Security policy developers

Risk assessment specialists Security professionals

Systems administrators
End users
Principles of Information Security, 3rd Edition 26

Data Ownership
Data owner: responsible for the security and use of a particular set of information

Data custodian: responsible for storage, maintenance, and protection of information Data users: end users who work with information to perform their daily jobs supporting the mission of the organization

Principles of Information Security, 3rd Edition

27

Communities of Interest
Group of individuals united by similar interests/values within an organization
Information security management and professionals
Information technology management and professionals Organizational management and professionals

Principles of Information Security, 3rd Edition

28

Information Security: Is it an Art or a Science?

Implementation of information security often described as combination of art and science

Security artesan idea: based on the way individuals perceive systems technologists since computers became commonplace

Principles of Information Security, 3rd Edition

29

Security as Art
No hard and fast rules nor many universally accepted complete solutions

No manual for implementing security through entire system

Principles of Information Security, 3rd Edition

30

Security as Science
Dealing with technology designed to operate at high levels of performance

Specific conditions cause virtually all actions that occur in computer systems Nearly every fault, security hole, and systems malfunction are a result of interaction of specific hardware and software If developers had sufficient time, they could resolve and eliminate faults
Principles of Information Security, 3rd Edition 31

Security as a Social Science

Social science examines the behavior of individuals interacting with systems

Security begins and ends with the people that interact with the system Security administrators can greatly reduce levels of risk caused by end users, and create more acceptable and supportable security profiles

Principles of Information Security, 3rd Edition

32

Key Terms
Access Asset Attack Control, Safeguard, or Countermeasure Exploit Exposure Hack Object Risk Security Blueprint Security Model Security Posture or Security Profile Subject Threats Threat Agent Vulnerability

Principles of Information Security, 3rd Edition

33

Summary
Information security is a well-informed sense of assurance that the information risks and controls are in balance Computer security began immediately after first mainframes were developed Successful organizations have multiple layers of security in place: physical, personal, operations, communications, network, and information

Principles of Information Security, 3rd Edition

34

Summary (continued)
Security should be considered a balance between protection and availability

Implementation of information security often described as a combination of art and science

Principles of Information Security, 3rd Edition

35