Current trends in information security โดย ผศ.ดร.ปราโมทย์ กั่วเจริญ
Download as PPTX, PDF2 likes933 views
This document outlines the curriculum for a program focused on information security, highlighting the need for professionals who can analyze risks and develop security policies. It details various courses, strategic IT security planning processes, threats, and the evolution of hackers and their techniques. Additionally, it provides insight into cybersecurity career opportunities and salary ranges for various roles within the field.
Current trends in information security โดย ผศ.ดร.ปราโมทย์ กั่วเจริญ
- 1. Information Security Assistant Professor Pramote Kuacharoen, Ph.D.
- 3. Information Security Curriculum • เป็นสาขาเกี่ยวกับการรักษาความมั่นคงปลอดภัยของสารสนเทศขององค์กร ซึ่ง มุ่งเน้นพัฒนาบุคลากรที่สามารถ วิเคราะห์ความเสี่ยงและวางแผนความมั่นคง ปลอดภัยขององค์กร สร้างนโยบายความมั่นคงปลอดภัย รักษาความมั่นคง ปลอดภัย และสามารถตอบสนองต่อภัยคุกคามต่าง ๆ เพื่อส่งเสริมพันธกิจของ องค์กร • ผู้ที่ศึกษาในสาขานี้จะได้ความรู้ ความเชี่ยวชาญทั้งทางด้านเทคโนโลยีเกี่ยวกับ ความมั่นคงสารสนเทศและการบริหารจัดการความมั่นคงสารสนเทศ
- 4. • Technology Is Concrete • Can visualize devices and transmission lines • Can understand device and software operation • Management Is Abstract • Management Is More Important • Security is a process, not a product (Bruce Schneier) 4 Management is the Hard Part
- 5. Courses • Information Security Management • Computer and Network Security • Information Security Risk Analysis • Software Development Security • Information Security Policy • Internet Security • Database Security • Software Development Security • Cloud Computing Security • Penetration Testing and Vulnerability Analysis • Digital Forensics and Investigations
- 7. • Identify Current IT Security Gaps • Identify Driving Forces • The threat environment • Compliance laws and regulations • Corporate structure changes, such as mergers • Identify Corporate Resources Needing Protection • Enumerate all resources • Rate each by sensitivity 7 Strategic IT Security Planning
- 8. • Develop Remediation Plans • Develop a remediation plan for all security gaps • Develop a remediation plan for every resource unless it is well protected • Develop an Investment Portfolio • You cannot close all gaps immediately • Choose projects that will provide the largest returns • Implement these 8 Strategic IT Security Planning
- 9. In The News Stealing Money using fake ID IDENTITY THEFT SOCIAL ENGINEERING OTP TWO-FACTOR AUTHENTICATION
- 10. Campus Area Networks AAA Server DHCP Server ESA/WSA Web ServerEmail Server VPN Hosts Layer 3 Switches Layer 2 Switches IPSFirewall Internet
- 11. Small Office and Home Office Networks Wireless Router Layer 2 Switch Internet
- 12. Wide Area Networks POP VPN Corporate Branch Site Regional Site SOHO Site Mobile Worker
- 13. The Evolving Network Border • Critical MDM functions for BYOD network – Data encryption – PIN enforcement – Data wipe – Data loss prevention – Jailbreak/root detection
- 14. The Hacker & The Evolution of Hackers Modern hacking titles: • Script Kiddies • Vulnerability Brokers • Hacktivists • Cyber Criminals • State-Sponsored Hackers Traditional Hackers • Motivated by thrill, validation of skills, sense of power • Motivated to increase reputation among other hackers • Often do damage as a byproduct • Often engage in petty crime
- 15. Script Kiddie
- 16. Cyber Criminals
- 17. Hacktivists
- 19. Attack Tools vs. Knowledge
- 20. Penetration Testing Tools Password Crackers Wireless Hacking Network Scanning and Hacking Packet Crafting Packet Sniffers Rootkit Detectors Fuzzers to Search Vulnerability Forensic Debuggers Hacking OS Encryption Tools Vulnerability Exploitation Vulnerability Scanners
- 21. Network Hacking Attacks • Eavesdropping • Data modification • IP address spoofing • Password-based • Denial-of-service • Man-in-the-middle • Compromised-key • Sniffer Reconnaissance Attacks Access Attacks DoS Attacks
- 26. Evolution of Network Security Tools IDS IPS Software Firewall Security Appliance
- 27. Next Generation Firewall (NGFW) • An integrated network platform that combines a traditional firewall with other network device filtering functionalities such as an application firewall using in-line deep packet inspection (DPI), an intrusion prevention system (IPS)
- 31. Encryption of Local Data Hardware Software
- 32. Switch Attack Categories Layer 2 Attacks CAM Table VLAN DHCP ARP Address Spoofing STP
- 34. Top 10 Highest Paying Jobs in Information Security 1. Chief Information Security Officer (CISO) $81,000- $240,000 2. Security Architect $84,000-$160,000 3. Security Director $66,000-$180,000 4. Security Manager $71,433-$143,374 5. Security Engineer $57,000-$128,000 6. Incident Responder $50,000-$150,000 7. Security Consultant $46,000-$147,000 8. Computer Forensics Expert $56,000-$119,000 9. Malware Analyst $48,000-$100,000 10. Security Specialist $43,000-$113,000
- 35. Cybersecurity Jobs • One Million Cybersecurity Job Openings In 2016 • Top Cyber Security Salaries In U.S. Metros Hit $380,000