Lecture 1 - Introduction To Security

UCI 403: INFORMATION
ASSURANCE AND SECURITY
Instructor: Rose Kapukha

Department of IT
MASENO UNIVERSITY
Introduction to Information Security
• Information security: Can be defined as:
Ø “well-informed sense of assurance that the information
risks and controls are in balance.” — Jim Anderson,
Inovant (2002)
Ø Can also be defined as “a state of being protected from

illegal access, damage or destruction”
• Security professionals must review the origins of this

field to understand its impact on our understanding of
information security today
2
The History of Information Security
• Computer security began immediately after the first
mainframes were developed
– Groups developing code-breaking computations during
World War II created the first modern computers
– Multiple levels of security were implemented
• Physical controls to limit access to sensitive military

locations to authorized personnel
• This approach was rudimentary in defending against

physical theft, espionage, and sabotage
3
What is Security?
A successful organization should have multiple layers of security in place:
i.Physical security: To protect the physical items, objects, or areas of an
organization from unauthorized access and misuse
ii.Personnel security: To protect the individual or group of individuals who are

authorized to access the organization and its operations
iii.Operations security: To protect the details of a particular operation or series of

activities.
iv.Communications security – To protect an organization’s communications

media, technology, and content.
v.Network security – To protect networking components, connections, and

contents. 4
What is Security? (cont’d.)
• The protection of information and its critical elements,
including systems and hardware that use, store, and
transmit that information
• Necessary tools for effective implementation of security:
i. Policy
ii. Awareness
iii. Training
iv. Education
v. technology
• In the early years, information security focused on
Confidentiality, Integrity, and Availability but this has
since been expanded to more dimensions. 5
Dimensions of Information Security:
i. Integrity – free from unauthorized modification
ii. Confidentiality – protection from possible access and viewing by

unauthorized entities
iii. Availability – accessible as and when need by authorized users
iv. Privacy – ensuring that information can ONLY be handed over to a

third party with the owners consent
v. Accounting – Tracking and recording the activities performed on a

resource e.g. a file on a server
vi. Non-repudiation – Guaranteeing that any entity that initiates a

process does not turn around and deny their activities
6
Consequences of Information security Breach
i. Legal action
ii. Loss of revenue
iii. Loss of data
iv. Loss of collaboration
v. Loss of license
vi. Inability to make decision
vii. Loss of clientele
viii. Soiled reputation

7
Key Information Security Concepts
• Access – subject or object’s ability to use gain entry into
an object
• Asset – Valuable object or resource that is to be

protected
• Attack - an act that is an intentional or unintentional

attempt to cause damage or compromise
• Control, Safeguard, or Countermeasure - security

mechanisms
8
• Exploit - to take advantage of weaknesses or vulnerability in
a system
• Exposure - a single instance of being open to damage
• Object - a passive entity in the information system that

receives or contains information.
• Vulnerability - weaknesses or faults in a system or protection

mechanism that expose information to attack or damage
9
• Risk - Risk - the probability that something can happen
• Subject - an active entity that interacts with an

information system and causes information to move
through the system Threat
• Threats - a category of objects, persons, or other

entities that represents a potential danger to an asset
10
• Computer can be subject of an attack and/or the object of an
attack
– When the subject of an attack, computer is used as an
active tool to conduct attack
– When the object of an attack, computer is the entity being
attacked
11
Critical Characteristics of Information
The value of information comes from the characteristics it
possesses:
• Availability: Enables users who need to access information
to do so without interference or obstruction
• Accuracy: Free from mistake or error and having the value

that the end user expects
• Authenticity: The quality or state of being genuine or

original, rather than a reproduction or fabrication
12
Critical Characteristics of Information
• Confidentiality: state of preventing disclosure or exposure to
unauthorized individuals
• Integrity: quality or state of being whole, complete, &

uncorrupted
• Utility: quality or state of having value for some purpose or

end
• Possession: quality or state of having ownership or control

of some object or item
13
Information Security Model
The McCumber Cube
14
Components of an Information System
• Information system (IS) is entire set of components
necessary to use information as a resource in the
organization.
• These components are normally targeted for attack by
malicious persons
– Software
– Hardware
– Data
– People
– Procedures
– Networks
15
Balancing Information Security & Access
• Impossible to obtain perfect security — it is a process,

not an absolute
• Security should be considered balance between

protection and availability
• To achieve balance, level of security must allow

reasonable access, yet protect against threats
16
Approaches to Information Security
Implementation: Bottom-Up Approach
• Grassroots effort: systems administrators attempt to
improve security of their systems
• Key advantage: technical expertise of individual

administrators
• Seldom works, as it lacks a number of critical features:

– Participant support
– Organizational staying power
17
Approaches to Information Security
Implementation: Top-Down Approach
• Initiated by upper management
– Issue policy, procedures, and processes
– Dictate goals and expected outcomes of project
– Determine accountability for each required action
• The most successful also involve formal development

strategy referred to as systems development life cycle
18
Information Security: Senior Management
• Chief Information Officer (CIO)
– Senior technology officer
– Primarily responsible for advising senior executives on

strategic planning
• Chief Information Security Officer (CISO)

– Primarily responsible for assessment, management, and
implementation of IS in the organization
– Usually reports directly to the CIO

19
Information Security Project Team
• A number of individuals who are experienced in one or
more facets of required technical and nontechnical areas:
– Champion
– Team leader
– Security policy developers
– Risk assessment specialists
– Security professionals
– Systems administrators
– End users 20
Data/Information Responsibilities
• Data/Information owner: responsible for the security
and use of a particular set of information
• Data/Information custodian: responsible for storage,

maintenance, and protection of information
• Data/Information users: end users who work with

information to perform their daily jobs supporting the
mission of the organization
21
Communities of Interest
• Group of individuals united by similar interests/values
within an organization
– Information security management and professionals
– Information technology management and professionals
– Organizational management and professionals
22
Information Security: Is it an Art or a
Science?
• Implementation of information security often described
as combination of art and science
• “Security artesan” idea: based on the way individuals

perceive systems technologists since computers became
commonplace
23
Security as Art
• No hard and fast rules nor many universally

accepted complete solutions
• No manual for implementing security through entire
system
24
Security as Science
• Dealing with technology designed to operate at high
levels of performance
• Specific conditions cause virtually all actions that occur

in computer systems
• Nearly every fault, security hole, and systems

malfunction are a result of interaction of specific
hardware and software
• If developers had sufficient time, they could resolve and

eliminate faults 25
Security as a Social Science
• Social science examines the behavior of individuals
interacting with systems
• Security begins and ends with the people that interact

with the system
• Security administrators can greatly reduce levels of risk

caused by end users, and create more acceptable and
supportable security profiles
26

Lecture 1 - Introduction To Security

Uploaded by

Copyright:

Available Formats

Lecture 1 - Introduction To Security

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lecture 1 - Introduction To Security

Uploaded by

Copyright:

Available Formats

UCI 403: INFORMATION

ASSURANCE AND SECURITY

Instructor: Rose Kapukha

Ø Can also be defined as “a state of being protected from

• Security professionals must review the origins of this

• Physical controls to limit access to sensitive military

• This approach was rudimentary in defending against

ii.Personnel security: To protect the individual or group of individuals who are

iii.Operations security: To protect the details of a particular operation or series of

iv.Communications security – To protect an organization’s communications

v.Network security – To protect networking components, connections, and

i. Integrity – free from unauthorized modification

ii. Confidentiality – protection from possible access and viewing by

iii. Availability – accessible as and when need by authorized users

iv. Privacy – ensuring that information can ONLY be handed over to a

v. Accounting – Tracking and recording the activities performed on a

vi. Non-repudiation – Guaranteeing that any entity that initiates a

ii. Loss of revenue

iii. Loss of data

iv. Loss of collaboration

vi. Inability to make decision

vii. Loss of clientele

viii. Soiled reputation

• Asset – Valuable object or resource that is to be

• Attack - an act that is an intentional or unintentional

• Control, Safeguard, or Countermeasure - security

• Exposure - a single instance of being open to damage

• Object - a passive entity in the information system that

• Vulnerability - weaknesses or faults in a system or protection

• Subject - an active entity that interacts with an

• Threats - a category of objects, persons, or other

• Accuracy: Free from mistake or error and having the value

• Authenticity: The quality or state of being genuine or

• Integrity: quality or state of being whole, complete, &

• Utility: quality or state of having value for some purpose or

• Possession: quality or state of having ownership or control

The McCumber Cube

• Impossible to obtain perfect security — it is a process,

• Security should be considered balance between

• To achieve balance, level of security must allow

• Key advantage: technical expertise of individual

• Seldom works, as it lacks a number of critical features:

– Dictate goals and expected outcomes of project

– Determine accountability for each required action

• The most successful also involve formal development

– Primarily responsible for advising senior executives on

• Chief Information Security Officer (CISO)

– Usually reports directly to the CIO

– Security policy developers

– Risk assessment specialists

• Data/Information custodian: responsible for storage,

• Data/Information users: end users who work with

– Information technology management and professionals

– Organizational management and professionals

• “Security artesan” idea: based on the way individuals

• No hard and fast rules nor many universally

• Specific conditions cause virtually all actions that occur

• Nearly every fault, security hole, and systems