Lecture-1 about programming language.pptx
- 1. 1 Information Security Lecture # 1 Dr. Shafiq Hussain Associate Professor & Chairperson Department of Computer Science
- 2. Dr Shafiq 2 Course Contents • Information security foundations, security design principles; security mechanisms, symmetric and asymmetric cryptography, encryption, hash functions, digital signatures, key management, authentication and access control; software security, vulnerabilities and protections, malware, database security; network security, firewalls, intrusion detection; security policies, policy formation and enforcement, risk assessment, cybercrime, law and ethics in information security, privacy and anonymity of data.
- 3. Dr Shafiq 3 Teaching Methodology • Lectures, Written Assignments, Semester Project, Presentations • Always try to contact me on email: drshafiq@uosahiwal.edu.pk • Email will be our official way of communication.
- 4. Dr Shafiq 4 Course Assessment • Mid Term Exam = 30 Marks • Sessional Marks (Home Assignments, Quizzes, Project, Presentations) = 20 Marks • Final Exam = 50 Marks • Total Marks = 100
- 5. Dr Shafiq 5 Reference Materials 1. Computer Security: Principles and Practice, 3rd edition by William Stallings 2. Principles of Information Security, 6th edition by M. Whitman and H. Mattord 3. Computer Security, 3rd edition by Dieter Gollmann 4. Computer Security Fundamentals, 3rd edition by William Easttom 5. Official (ISC)2 Guide to the CISSP CBK, 3rd edition
- 6. 6 Objectives • Introduction to Information security
- 7. 7 Information Security • Information security is the practice of protecting information by mitigating information risks. • It involves the protection of information systems and the information processed, stored, and transmitted by these systems from unauthorized access, use, disclosure, disruption, modification, or destruction.
- 8. 8 Information Security (Cont..) • This includes the protection of personal information, financial information, and sensitive or confidential information stored in both digital and physical forms. • Effective information security requires a comprehensive and multi-disciplinary approach, involving people, processes, and technology.
- 9. 9 Information Security (Cont..) • Information Security is basically the practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording, or destruction of information. • Information can be a physical or electronic one.
- 10. 10 Information Security (Cont..) • Information can be anything like Your details or we can say your profile on social media, your data on your mobile phone, your biometrics, etc. • Information Security spans so many research areas like Cryptography, Mobile Computing, Cyber Forensics, Online Social Media, etc.
- 11. 11 Principles of Information Security • Information security is necessary to ensure the confidentiality, integrity, and availability of information, whether it is stored digitally or in other forms such as paper documents.
- 12. 12 Principles of Information Security (Cont..) • Information Security programs are build around 3 objectives, commonly known as CIA – Confidentiality, Integrity, Availability.
- 13. 13 Principles of Information Security (Cont..) • Confidentiality – Means information is not disclosed to unauthorized individuals, entities and process. • For example if we say I have a password for my Gmail account but someone saw while I was doing a login into Gmail account. In that case my password has been compromised and Confidentiality has been breached.
- 14. 14 Principles of Information Security (Cont..) • Integrity – Means maintaining accuracy and completeness of data. This means data cannot be edited in an unauthorized way. • For example if an employee leaves an organisation then in that case data for that employee in all departments like accounts, should be updated to reflect status to JOB LEFT so that data is complete and accurate.
- 15. 15 Principles of Information Security (Cont..) • Availability – Means information must be available when needed. • For example if one needs to access information of a particular employee to check whether employee has outstanded the number of leaves, in that case it requires collaboration from different organizational teams like network operations, development operations, incident response and policy/change management.
- 16. 16 Principles of Information Security (Cont..)
- 17. 17 Principles of Information Security (Cont..) • Non-Repudiation – Means one party cannot deny receiving a message or a transaction nor can the other party deny sending a message or a transaction. • For example in cryptography it is sufficient to show that message matches the digital signature signed with sender’s private key and that sender could have a sent a message and nobody else could have altered it in transit.
- 18. 18 Principles of Information Security (Cont..) • Authenticity – Means verifying that users are who they say they are and that each input arriving at destination is from a trusted source. • This principle if followed guarantees the valid and genuine message received from a trusted source through a valid transmission.
- 19. 19 Principles of Information Security (Cont..) • Accountability – This means that it should be possible to trace actions of an entity uniquely to that entity.
- 20. 20 Information Security Management System • An Information Security Management System (ISMS) is a structured framework designed to protect an organization’s information assets. • It includes policies, procedures, and controls to manage and secure sensitive data from threats like unauthorized access, data breaches, and cyberattacks.
- 21. 21 Information Security Management System (Cont..) • By following international standards like ISO/IEC 27001, an ISMS helps organizations identify risks, implement security measures, and continuously improve their security practices to safeguard their information.
- 22. 22 General Data Protection Regulation • The General Data Protection Regulation (GDPR) is a comprehensive privacy law established by the European Union (EU) to protect individuals’ personal data. • Effective since May 25, 2018, GDPR sets strict rules on how personal data is collected, used, stored, and shared.
- 23. 23 General Data Protection Regulation (Cont..) • It grants individuals more control over their data, including rights to access, correct, and delete their information. • GDPR also requires organizations to be transparent about their data practices and to implement strong security measures.
- 24. 24 Types of Information Security • Network Security: Protects computer networks from attacks and unauthorized access using tools like firewalls, Intrusion Detection Systems (IDS), and Virtual Private Networks (VPNs). • For example, a firewall can block malicious traffic trying to enter a company’s network.
- 25. 25 Types of Information Security (Cont..) • Application Security: Secures software applications by finding and fixing vulnerabilities, using methods like code reviews and security patches. • An example is a web application firewall (WAF) that prevents attacks on websites by filtering and monitoring HTTP traffic.
- 26. 26 Types of Information Security (Cont..) • Data Security: Ensures data safety during storage and transfer by using encryption and data masking. • For instance, encrypted emails are unreadable to anyone without the decryption key, protecting sensitive information.
- 27. 27 Types of Information Security (Cont..) • Endpoint Security: Secures individual devices such as computers, smartphones, and tablets through antivirus software and Endpoint Detection and Response (EDR) tools. • An example is an antivirus program that scans and removes malware from a personal laptop.
- 28. 28 Types of Information Security (Cont..) • Cloud Security: Protects data and applications hosted in cloud environments with measures like secure cloud configurations and Identity and Access Management (IAM). • For instance, using multi-factor authentication (MFA) helps ensure that only authorized users can access cloud-based services.
- 29. 29 Issues of Information Security • Cyber threats: The increasing sophistication of cyber attacks, including malware, phishing, and ransomware, makes it difficult to protect information systems and the information they store.
- 30. 30 Issues of Information Security (Cont..) • Cyber threats: The increasing sophistication of cyber attacks, including malware, phishing, and ransomware, makes it difficult to protect information systems and the information they store.
- 31. 31 Questions Any Question Please? You can contact me at: drshafiq@uosahiwal.edu.pk Your Query will be answered within one working day.
- 32. 32 Further Readings • Chapter No. 1 Computer_Security_Principles_and_Practice_(3rd_E dition) By William Stallings and Lawrie Brown
- 33. 33 Thanks