Itt2 its introduction
- 1. Morten Bo Nielsen – mon@eal.dk 1/12 ITT2 IT security introduction 2014S
- 2. Morten Bo Nielsen – mon@eal.dk 2/12 Today 1.Quick introduction • Course and security in general 2.Risk • The NIST way 3.Exercise time
- 3. Morten Bo Nielsen – mon@eal.dk 3/12 Course plan It will be on fronter soon (soory about the delay)
- 4. Morten Bo Nielsen – mon@eal.dk 4/12 Course What is security? Technical vs. non-technical Risk (both known and unknown)
- 5. Morten Bo Nielsen – mon@eal.dk 5/12 Formal stuff NIST 800-30 ISO 27000 family
- 6. Morten Bo Nielsen – mon@eal.dk 6/12 Informal stuff Sans 20 critical security controls Blogs, magazines, opinions, articles, FUD and so on
- 7. Morten Bo Nielsen – mon@eal.dk 7/12 NIST 800-30 2.3.1 Risk Models (p. 8) Figure 5: RISK ASSESSMENT PROCESS (p. 23) TABLE D-2:TAXONOMY OFTHREAT SOURCES (p. D-2) TABLE F-4:TAXONOMY OF PREDISPOSING CONDITIONS (p. F-4)
- 8. Morten Bo Nielsen – mon@eal.dk 8/12 Know this Threat +Vulnerability = Attack Likelihood x Impact = Risk Impact: Confidentiality, Integrity,Availability
- 9. Morten Bo Nielsen – mon@eal.dk 9/12 Risk RISK
- 10. Morten Bo Nielsen – mon@eal.dk 10/12 Assignment context ● 30 employees ● Architechs ● State any other assumptions
- 11. Morten Bo Nielsen – mon@eal.dk 11/12 Assignment ● Consider threats, vulnerabilities, likelihood and impact ● File server backup failed ● CEO login credentials stolen ● User writes bad password three times and is locked out ● Internet connection fails ● Homepage is defaced
- 12. Morten Bo Nielsen – mon@eal.dk 12/12 Credits & licences ● Content by Morten Bo Nielsen License: Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License. (http://creativecommons.org/licenses/by-nc-sa/3.0/) ● EAL logo might be an issue, please check before you use it