IT Security and Management - Prelim Lessons by Mark John Lado

ACCESS CONTROL
ASSET MANAGEMENT
BUSINESS CONTINUITY
IT SECURITY AND MANAGEMENT
BSIS 2
SECURITY POLICIES

At the end of the first chapter, learners will be able to;
1. Know about access control.
2. Differentiate the physical and logical access control.
3. Engage with different examples of access control.
4. Apply the role of access control in their future
projects.
LESSON OBJECTIVES

Access control.
Physical and logical access control.
Examples of access control.
Role of access control in their future
projects.
LEARNING TOPICS

1. What is the main purpose of access
control?
2. Why is access control important?
LEARNING ACTIVITY

A security technique that regulates who
or what can view or use resources in a
computing environment. It is a
fundamental concept in security that
minimizes risk to the business or
organization.
ACCESS CONTROL

To secure a facility, organizations use
electronic access control systems that rely on
user credentials, accesss card reader,
auditing and reports track employee access
to restricted business locations and
proprietary areas, such as data centers.
ACCESS CONTROL

Protecting a corporate
using biometric
authentication system.
Use biometric access
system instead of
passwords for access to
offices.
ACCESS CONTROL

Use 3D face
recognition instead of
passwords for access to
corporate.
ACCESS CONTROL

1. Physical Access Control - limits access to
campuses, buildings, rooms and physical IT
assets.
2. Logical Access Control - limits connections
to computer networks, system files and
data.
TWO TYPES OF ACCESS CONTROL

Physical Access
Control

Logical Access
Control

1.Discretionary Access Control
2.Mandatory Access Control
3.Role-based Access Control
EXAMPLES OF ACCESS CONTROL SYSTEM

In a system, every object has an owner.
With DAC, access control is determined
by the owner of the object who decides
who will have access and what privileges
they will have. Permission management
in DAC can be very difficult to maintain.
Discretionary Access Control

Access policy is determined by the
system and is implemented by sensitivity
labels, which are assigned to each
subject and object. A subject's label
specifies its level of trust, and an object's
label specifies the level of trust that is
required to access it.
Mandatory Access Control

MAC is a pre-defined set of
capabilities and access to
information.
(who can share what to
who)

User works in a company and company
decides how data should be shared.
Example.
“Hospital owns patient records and limits
their sharing.”

Access policy is determined by the system.
Where with MAC access is based on subject
trust or clearance, with RBAC access is
based on the role of the subject. A subject
can access an object or execute a function
only if their set of permissions —or role—
allows it.
Role-based Access Control

Role-based Access Control
Access rights
are
associated
with roles.

1.Rule-based Access Control
2.Attribute-based Access Control
TWO TYPES OF ROLE-BASED ACCESS CONTROL

A security model in which the system
administrator defines the rules that to
govern access to resource objects. Often
these rules are based on conditions, such
as time of day, position or the location
site.
RULE-BASED ACCESS CONTROL

A methodology that manages access
rights by evaluating a set of rules,
policies and relationships using the
attributes of users, systems and
environmental conditions.
ATTRIBUTE-BASED ACCESS CONTROL

RBAC and ABAC are two types of access
control methods. The main difference
between RBAC and ABAC is that the RBAC
provides access rights depending on the user
roles while the ABAC provides access rights
considering user, resource, and environment
attributes.
RBAC AND ABAC

To minimize the risk of unauthorized access
to physical and logical systems. Access
control is a fundamental component of
security compliance programs that ensures
security technology and access control
policies are in place to protect confidential
information, such as customer data.
THE GOAL OF ACCESS CONTROL

Why we need to be secure?
What is data privacy?
WRAPPING UP..!

1. How would you prevent spam?
2. How would you fight unauthorized access?
3. How could you keep your data secured?
4. How could you maintain confidentiality?
½ CROSS WISE CLEAN PAPER

ASSET MANAGEMENT
BSIS 2
SECURITY POLICIES

At the end of the second chapter, learners will be able
to;
1. Recognize about asset management.
2. Distinguish the three goals of an asset management
program.
3. Engage with different types of IT asset Management.
LESSON OBJECTIVES

Asset management.
The three goals of an asset management
program.
Different types of it asset management.
LEARNING TOPIC

Oral
1. What is an asset?
LEARNING ACTIVITY

Oral
2. How would you manage your
assets?
LEARNING ACTIVITY

Oral
3. How would you secure your
assets?
LEARNING ACTIVITY

Oral
4. What is information technology
asset management
LEARNING ACTIVITY

IT asset management (information technology
asset management, or ITAM) is a set of business
practices that combines financial, inventory and
contractual functions to optimize spending and
support lifecycle management and strategic
decision-making within the IT environment .
ASSET MANAGEMENT

ITAM is about more than creating an
asset inventory. It's about continually
using the captured asset data to
maximize returns, minimize risk and
drive increased business value.
WHY ITAM IS IMPORTANT?

By avoiding unnecessary asset
purchases and making the best use of
current resources, IT asset managers
can cut software licensing and
support costs, eliminate waste and
improve efficiency.

ITAM also helps increase the company-wide
understanding of IT's business value, improves
communications and understanding between IT
and other departments, enforces compliance with
cyber-security policies and regulatory
requirements, improves productivity through
technology support, and limits overhead costs of
managing the IT environment.

3 OBJECTIVES OF AN ASSET MANAGEMENT PROGRAM

1. PLAN AND ORGANIZE YOUR DEVICES

1. PLAN AND ORGANIZE YOUR DEVICES
Setup your asset management tools to reflect your
organization’s plan. Consider all of your devices no
matter whether they are on or off your corporate
network. Then, document the purpose of each device.
Also, document the expected lifespan of each device
including the refresh cycles, lease date or end of life
warranty.

2. KEEP DEVICES VISIBLE AND HEALTHY

2. KEEP DEVICES VISIBLE AND HEALTHY
Developing and implementing your IT asset
management plan ensures that you have a living
baseline to measure your population against. With this
knowledge, you can effectively monitor your devices’
performance, health, and risk exposure, and make
informed decisions about changes to your environment.

3. RETIRE DEVICES

3. RETIRE DEVICES
To have an effective IT asset management plan
and a capable information security practice, you
need to trust your data and ensure that the
devices important to you are monitored and
protected. This means that your devices need a
retirement plan.

3. RETIRE DEVICES
Establishing a process for your devices’ end of life
from the time they first enter your environment
means that your devices are collected, secured,
sanitized, and removed from your environment
when the time comes.

3. RETIRE DEVICES
It also means that the information you rely on to
make critical information security and IT
operations decisions is accurate and the alerts
you receive when something unexpected happens
are real.

What are the types of
IT asset Management?
IT ASSET MANAGEMENT

1. SOFTWARE
IT ASSET MANAGEMENT

1. SOFTWARE
Software asset management (SAM) is a
business practice that involves managing
and optimizing the purchase, deployment,
maintenance, utilization, and disposal of
software applications within an organization.
IT ASSET MANAGEMENT

2. HARDWARE
IT ASSET MANAGEMENT

2. HARDWARE
Hardware asset management (HAM) is the
process of managing the physical components
of computers, computer networks and
systems. This begins with acquisition and
continues through maintenance until the
hardware's ultimate disposal.
IT ASSET MANAGEMENT

3. MOBILE DEVICES
IT ASSET MANAGEMENT

3. MOBILE DEVICES
Mobile devices should certainly be
treated as an asset; therefore it falls
under the ITAM remit. Mobile devices
should be treated like any other asset; it
needs constant monitoring and
management throughout its lifecycle.
IT ASSET MANAGEMENT

3. MOBILE DEVICES
The challenge with mobile devices
however is the fact that they are mobile.
They can be moved from location to
location a lot easier than a desktop, and
some are small enough to get lost.
IT ASSET MANAGEMENT

4. CLOUD DATABASE
IT ASSET MANAGEMENT

4. CLOUD DATABASE
Cloud asset management (CAM) is a
component of cloud management services
focused exclusively on the management of a
business’s physical cloud environment, such
as the products or services they use.
IT ASSET MANAGEMENT

4. CLOUD DATABASE
Put simply, CAM keeps track of every aspect
of your cloud estate, managing the
maintenance, compliance, upgrading, and
disposal of cloud assets.
IT ASSET MANAGEMENT

What does an IT asset manager do?
WRAPPING UP!

The IT Asset Manager is responsible for the
daily and long-term strategic management of
software and technology-related hardware
within the organization. This includes
planning, monitoring, and recording software
license and/or hardware assets to ensure
compliance with vendor contracts.
WHAT DOES AN IT ASSET MANAGER DO?

Why is IT asset management important?
WRAPPING UP!

Asset management is important because it
helps a company monitor and manage their
assets using a systemized approach.
Managed effectively, the benefits include
improvements to productivity and efficiency
which places a business in a better position
to increase their return on investment.
WHY IS IT ASSET MANAGEMENT IMPORTANT?

An asset is anything of value or a
resource of value that can be converted
into cash. Individuals, companies, and
governments own assets.
WRAPPING UP!

1.Give a dialog about asset management.
2. Distinguish and discuss the three goals of
an asset management program.
3. Give the different types of IT asset
Management and write a brief dialog.

BUSINESS CONTINUITY
BSIS 2
SECURITY POLICIES

At the end of the third chapter, learners will be able to;
1. Elaborate about business continuity.
2. Engage with the types of business continuity.
3. Know about the steps for building and
executing of business continuity.
4. Familiarize the business continuity strategy.
LEARNING OBJECTIVES

Introduction to Business Continuity
Types of Business Continuity
Steps for Building and Executing of
Business Continuity
Business Continuity Strategy
LEARNING TOPICS

What is Business?
LEARNING ACTIVITY

What is Business Continuity?
LEARNING ACTIVITY

How to maintain the good performance
of the business?
LEARNING ACTIVITY

How to prevent your business from risks?
LEARNING ACTIVITY

Business continuity is an organization’s
ability to ensure operations and core
business functions are not severely
impacted by a disaster or unplanned
incident that take critical systems offline.
BUSINESS CONTINUITY

A variety of events cause digital business
disruptions. Just because you’re not at
risk of one particular cataclysmic
disaster doesn’t mean many other
incidents can’t take you offline:
TYPES OF BUSINESS CONTINUITY

1. Disasters: Natural and Local

1. Disasters: Natural and Local
Data loss and system failure can obviously be
caused by natural disasters such as floods,
earthquakes and fires, but even a simple
electronic malfunction could destroy valuable
information. When it comes to data, putting all
your eggs in one basket is a perilous risk.

2. Network Disruptions

2. Network Disruptions
Third party internet networks can fail. Fiber
can get cut. Your in-house local area
network can be disabled. If your business
needs continuous connectivity, make sure
network availability is a top priority.

3. Cyber security

3. Cyber security
The prevalence of cyber security threats are a
global phenomenon that no business, large or
small, can ignore. New threats such as Ransom
ware are predicted to be on the rise. Backing up
your data with high frequency is crucial to
ensuring such attacks don’t bring your business
down plan against data breach is paramount.

4. Human error

4. Human error
Vulnerability points are often located right
in the cubicle next to you. Employees or
vendors can cause outages simply out of
ignorance, due to innocent mistakes, or
even as a result of ill intent.

Steps for Building And
Executing Your Business Continuity Plan
BUSINESS CONTINUITY

If your business is behind in disaster
planning, you don’t have to catch up
alone. Whether taking on business
continuity planning alone or with a third
party, follow these three steps to start
protecting your company from unplanned
downtime.
STEPS FOR BUILDING AND EXECUTING
YOUR BUSINESS CONTINUITY PLAN

Step 1:
Perform a Business Impact Analysis

A business impact analysis
defines what data your company
cannot live without and the
amount of downtime acceptable
in a given period of time.
PERFORM A BUSINESS IMPACT ANALYSIS

Finding a hosting provider that promises
100% uptime will help with this, but you’ll
also need to determine two important
numbers key to disaster recovery:
Recovery Time Objective
Recovery Point Objective
PERFORM A BUSINESS IMPACT ANALYSIS

The Recovery Time Objective (RTO) is the
targeted duration of time and a service level
within which a business process must be
restored after a disaster (or disruption) in
order to avoid unacceptable consequences
associated with a break in business
continuity.
RECOVERY TIME OBJECTIVE

The recovery point objective (RPO) is the
age of files that must be recovered from
backup storage for normal operations to
resume if a computer, system, or network
goes down as a result of a hardware,
program, or communications failure.
RECOVERY POINT OBJECTIVE

Step 2:
Perform a Risk Assessment

This step is critical if you manage your
own infrastructure. Risk assessments
are all about identifying potential
points of failure.
PERFORM A RISK ASSESSMENT.

For example, if you have your data stored
in only one location and the location
dies, you will lose your data. If a hosting
provider is in charge of your servers and
data within a data center, ideally you will
have everything stored and replicated in
more than one location.
PERFORM A RISK ASSESSMENT.

Step 3:
Manage Your Risks

Once you’ve assessed the risks, you
must manage them — whether your
data and infrastructure lives in house,
with a hosting provider, or a
combination of both.
MANAGE YOUR RISKS

Regularly backup your data offsite as
specified by your business continuity
plan and go a step beyond by adding
redundant, offsite infrastructure to
your network to ensure 100 percent
uptime.
MANAGE YOUR RISKS

6 STRATEGIES OF BUSINESS CONTINUITY

1. Personalized File Backups

Server-level backups are an important
component of any company’s business
continuity strategy. Whether your files
are stored 100% in the cloud or your
company embraces a hybrid cloud and
on-site server strategy,
1. PERSONALIZED FILE BACKUPS

most companies are regularly backing
up information like client data,
financial information and other
critical information. Often, physical
versions of your most important files
are kept at another location.
1. PERSONALIZED FILE BACKUPS

2. Email Continuity Solutions

Email Continuity acts as a backup email system
that can temporarily take the place of your mail
server when it goes down. There are many
reasons that an email system might go
temporarily offline. Email Continuity allows you to
continue receiving and sending emails using your
normal email address.
2. EMAIL CONTINUITY SOLUTIONS

3. Cross-Device Continuity Solutions

Whether you’re facing a server outage or a
physical issue like a major storm, downtime
can have critical consequences for your
business. Employee communications get cut
off, critical systems aren’t processing
transactions and customers see that your
website is offline.
3. CROSS-DEVICE CONTINUITY SOLUTIONS

An important tactical part of any small or
mid-sized business continuity plan is
thinking about cross-device continuity
solutions. One set of devices that is
probably still working is your employees’
mobile devices.
3. CROSS-DEVICE CONTINUITY SOLUTIONS

4. Collaboration and Communication
Software

In order to access communications from
any device no matter where they are,
companies of all sizes are increasingly
relying on unified messaging approach,
which means integrating all texts,
emails, faxes etc. onto a single interface.
4. COLLABORATION AND
COMMUNICATION SOFTWARE

Whether you’ve got in-house teams on
opposite coasts or contractors on a different
continent, the right tools enable efficient
collaboration and communication.
4. COLLABORATION AND
COMMUNICATION SOFTWARE

5. Allocating Your Technology Budget
and Resources

Add a line item for business continuity to
your IT budget. Companies typically spend
between 4 and 6% of their budgets on
IT. Whether it’s investing in the right systems
or ensuring you have the on-demand IT talent
needed for fast responses, every company
needs funds set aside for business continuity
and disaster response.
5. ALLOCATING YOUR TECHNOLOGY
BUDGET AND RESOURCES

Yet it’s critical to realize that the most
complex and efficient plans are
useless without the resources to
execute.
5. ALLOCATING YOUR TECHNOLOGY
BUDGET AND RESOURCES

6. Empowering Staff

It’s important to empower employees to
take action in the case of a disaster. For
example, by having clear decision rights
outlined in your recovery plan, you’re
enabling your team to take action and
more quickly resolve any issues.
6. EMPOWERING STAFF

When business is disrupted, it can cost
money. Lost revenues plus extra expenses
means reduced profits. Insurance does not
cover all costs and cannot replace customers
that defect to the competition. A business
continuity plan to continue business is
essential.
BUSINESS CONTINUITY

How to prevent your business from risks?
WRAPPING UP!

Give a dialog about business continuity.
WRAPPING UP!

Cite the types of business continuity.
WRAPPING UP!

Enumerate the steps for building and
WRAPPING UP!

Give the 6 business continuity strategy.
WRAPPING UP!

1. Give a dialog about business continuity.
2. Cite the types of business continuity.
3. Enumerate the steps for building and
4. Give the 6 business continuity strategy.

You learned about;
1.ACCESS CONTROL
2.ASSET MANAGEMENT
3.BUSINESS CONTINUITY
END OF THE TERM

IT Security and Management - Prelim Lessons by Mark John Lado

More Related Content

What's hot (20)

Similar to IT Security and Management - Prelim Lessons by Mark John Lado (20)

More from Mark John Lado, MIT (20)

Recently uploaded (20)

IT Security and Management - Prelim Lessons by Mark John Lado