Information security and other issues
- 1. IT Security and Other Issues Presented By : Sir Haseeb Ahmed
- 2. DEFINITION: • The protection of information and its elements including system, hardware that use, store and transmit the information PRIMARY GOALS CIA triangle known as security triad tells the primary goals of IS Confidentiality • Making sure that those who should not see information Integrity • Making sure that the information has not been changed from its original Availability • Making sure that the information is available for use when you need it.
- 3. What is Information Security? • Known as InfoSec, which is the practice of defending information from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. • It is a general term that can be used regardless of the form the data may take (electronic, physical, etc...) • I.T. Security: Sometimes referred to as computer security, Information Technology Security is information security applied to technology (most often some form of computer system). • It is worthwhile to note that a computer does not necessarily mean a home desktop. A computer is any device with a processor and some memory. • IT security specialists: are almost always found in any major enterprise/establishment due to the nature and value of the data within larger businesses. • Information assurance: The act of ensuring that data is not lost when critical issues arise. • These issues include but are not limited to: natural disasters, computer/server malfunction, physical theft, or any other instance where data has the potential of being lost. • Since most information is stored on computers in our modern era, information assurance is typically dealt with by IT security specialists. • One of the most common methods of providing information assurance is to have an off-site backup of the data in case one of the mentioned issues arise.
- 4. Threats to Information System? • There are many information security threats that we need to be constantly aware of and protect against in order to ensure our sensitive information remains secure. Unauthorized Access – Enter at your own risk The attempted or successful access of information or systems, without permission or rights to do so. Ensure you have a properly configured firewall, up to date malware prevention software and all software has the latest security updates. Protect all sensitive information, utilizing encryption where appropriate, and use strong passwords that are changed regularly. Cyber Espionage – Hey, get off my network! The act of spying through the use of computers, involving the covert access or ‘hacking’ of company or government networks to obtain sensitive information. Be alert for social engineering attempts and verify all requests for sensitive information. Ensure software has the latest security updates, your network is secure and monitor for unusual network behavior. Malware – You installed what?! A collective term for malicious software, such as viruses, worms and trojans; designed to infiltrate systems and information for criminal, commercial or destructive purposes. Ensure you have a properly configured firewall, up to date malware prevention and all software has the latest security updates. Do not click links or open attachments in emails from unknown senders, visit un-trusted websites or install dubious software. Data Leakage – I seek what you leak. The intentional or accidental loss, theft or exposure of sensitive company or personal information Ensure all sensitive information stored on removable storage media, mobile devices or laptops is encrypted Be mindful of what you post online, check email recipients before pressing send, and never email sensitive company information to personal email accounts
- 5. Threats to Information System? Mobile Device Attack – Lost, but not forgotten. The malicious attack on, or unauthorized access of mobile devices and the information stored or processed by them; performed wirelessly or through physical possession. Keep devices with you at all times, encrypt all sensitive data and removable storage media, and use strong passwords. Avoid connecting to insecure, un-trusted public wireless networks and ensure Bluetooth is in ‘undiscoverable’ mode. Spam – Email someone else Unsolicited email sent in bulk to many individuals, usually for commercial gain, but increasingly for spreading malware. Only give your email to those you trust and never post your address online for others to view. Use a spam filter and never reply to spam emails or click links within them. Mobile Device Attack – Lost, but not forgotten. The theft of an unknowing individual’s personal information, in order to fraudulently assume that individual’s identity to commit a crime, usually for financial gain. Never provide personal information to un-trusted individuals or websites. Ensure personal information is protected when stored and securely disposed of when no longer needed.
- 6. Protecting Information System Information Security Controls Computer security, specifically, is the protection of data in a system against unauthorized disclosure, modification, or destruction and protection of the computer system itself against unauthorized use, modification, or denial of service. Physical Controls It is the use of locks, security guards, badges, alarms, and similar measures to control access to computers, related equipment (including utilities), and the processing facility itself. In addition, measures are required for protecting computers, related equipment, and their contents from espionage, theft, and destruction or damage by accident, fire, or natural disaster (e.g., floods and earthquakes). Technical Controls Involves the use of safeguards incorporated in computer hardware, operations or applications software, communications hardware and software, and related devices. Technical controls are sometimes referred to as logical controls. Preventive technical controls are used to prevent unauthorized personnel or programs from gaining remote access to computing resources. Examples of these controls include: •Access control software •Antivirus software •Library control systems •Passwords
- 7. Protecting Information System • Smart cards • Encryption • Dial-up access control and callback systems Administrative Controls Consists of management constraints, operational procedures, accountability procedures, and supplemental administrative controls established to provide an acceptable level of protection for computing resources. In addition, administrative controls include procedures established to ensure that all personnel who have access to computing resources have the required authorizations and appropriate security clearances. Preventive administrative controls are personnel-oriented techniques for controlling people’s behavior to ensure the confidentiality, integrity, and availability of computing data and programs. Examples of preventive administrative controls include: • Security awareness and technical training • Separation of duties • Procedures for recruiting and terminating employees • Security policies and procedures • Supervision. • Disaster recovery, contingency, and emergency plans • User registration for computer access
- 8. Internet Security? In 1980 a computer cracked a 3-character password within one minute. In 1999 a team of computers cracked a 56-character password within one day. In 2004 a computer virus infected 1 million computers within one hour. 1.Computer Virus: •Needs a host file •Copies itself •Executable 2.Network Worm •No host (self-contained) •Copies itself •Executable 3.Trojan Horse: •No host (self-contained) •Does not copy itself •Imposter Program