Lesson 2
- 1. Principles of Information Security, Fifth Edition Chapter 2 The Need for Security Lesson 2 – Threats
- 2. Learning Objectives • Upon completion of this material, you should be able to: – Explain why a successful information security program is the shared responsibility of an organization’s general management and IT management – List and describe the threats posed to information security Principles of Information Security, Fifth Edition 2
- 3. Threats • Threat: a potential risk to an asset’s loss of value • Management must be informed about the various threats to an organization’s people, applications, data, and information systems. • Overall security is improving, so is the number of potential hackers. • The 2010–2011 CSI/FBI survey found – 67.1 percent of organizations had malware infections. – 11 percent indicated system penetration by an outsider. Principles of Information Security, Fifth Edition 3
- 4. Principles of Information Security, Fifth Edition 4
- 5. Principles of Information Security, Fifth Edition 5
- 6. Principles of Information Security, Fifth Edition 6
- 7. Compromises to Intellectual Property • Intellectual property (IP): creation, ownership, and control of original ideas as well as the representation of those ideas • The most common IP breaches involve software piracy. • Two watchdog organizations investigate software abuse: – Software & Information Industry Association (SIIA) – Business Software Alliance (BSA) • Enforcement of copyright law has been attempted with technical security mechanisms. Principles of Information Security, Fifth Edition 7
- 8. Deviations in Quality of Service • Information system depends on the successful operation of many interdependent support systems. • Internet service, communications, and power irregularities dramatically affect the availability of information and systems. Principles of Information Security, Fifth Edition 8
- 9. Deviations in Quality of Service (cont’d) • Internet service issues – Internet service provider (ISP) failures can considerably undermine the availability of information. – Outsourced Web hosting provider assumes responsibility for all Internet services as well as for the hardware and Web site operating system software. • Communications and other service provider issues – Other utility services affect organizations: telephone, water, wastewater, trash pickup. – Loss of these services can affect organization’s ability to function. Principles of Information Security, Fifth Edition 9
- 10. Principles of Information Security, Fifth Edition 10
- 11. Deviations in Quality of Service (cont’d) • Power irregularities – Commonplace – Lead to fluctuations such as power excesses, power shortages, and power losses – Sensitive electronic equipment vulnerable to and easily damaged/destroyed by fluctuations – Controls can be applied to manage power quality. Principles of Information Security, Fifth Edition 11
- 12. Espionage or Trespass • Access of protected information by unauthorized individuals • Competitive intelligence (legal) versus industrial espionage (illegal) • Shoulder surfing can occur anywhere a person accesses confidential information. • Controls let trespassers know they are encroaching on organization’s cyberspace. • Hackers use skill, guile, or fraud to bypass controls protecting others’ information. Principles of Information Security, Fifth Edition 12
- 13. Principles of Information Security, Fifth Edition 13
- 14. Espionage or Trespass (cont’d) • Expert hacker – Develops software scripts and program exploits – Usually a master of many skills – Will often create attack software and share with others • Unskilled hacker – Many more unskilled hackers than expert hackers – Use expertly written software to exploit a system – Do not usually fully understand the systems they hack Principles of Information Security, Fifth Edition 14
- 15. Principles of Information Security, Fifth Edition 15
- 16. Espionage or Trespass (cont’d) • Other terms for system rule breakers: – Cracker: “cracks” or removes software protection designed to prevent unauthorized duplication – Phreaker: hacks the public telephone system to make free calls or disrupt services • Password attacks – Cracking – Brute force – Dictionary – Rainbow tables – Social engineering Principles of Information Security, Fifth Edition 16
- 17. Principles of Information Security, Fifth Edition 17
- 18. Forces of Nature • Forces of nature can present some of the most dangerous threats. • They disrupt not only individual lives, but also storage, transmission, and use of information. • Organizations must implement controls to limit damage and prepare contingency plans for continued operations. Principles of Information Security, Fifth Edition 18
- 19. Human Error or Failure • Includes acts performed without malicious intent or in ignorance • Causes include: – Inexperience – Improper training – Incorrect assumptions • Employees are among the greatest threats to an organization’s data. Principles of Information Security, Fifth Edition 19
- 20. Principles of Information Security, Fifth Edition 20
- 21. Human Error or Failure (cont’d) • Employee mistakes can easily lead to: – Revelation of classified data – Entry of erroneous data – Accidental data deletion or modification – Data storage in unprotected areas – Failure to protect information • Many of these threats can be prevented with training, ongoing awareness activities, and controls. • Social engineering uses social skills to convince people to reveal access credentials or other valuable information to an attacker. Principles of Information Security, Fifth Edition 21
- 22. Social Engineering • “People are the weakest link. You can have the best technology; firewalls, intrusion-detection systems, biometric devices ... and somebody can call an unsuspecting employee. That's all she wrote, baby. They got everything.”—Kevin Mitnick • Advance-fee fraud: indicates recipient is due money and small advance fee/personal banking information required to facilitate transfer • Phishing: attempt to gain personal/confidential information; apparent legitimate communication hides embedded code that redirects user to third-party site Principles of Information Security, Fifth Edition 22
- 23. Principles of Information Security, Fifth Edition 23
- 24. Information Extortion • Attacker steals information from a computer system and demands compensation for its return or nondisclosure. Also known as cyberextortion. • Commonly done in credit card number theft Principles of Information Security, Fifth Edition 24
- 25. Sabotage or Vandalism • Threats can range from petty vandalism to organized sabotage. • Web site defacing can erode consumer confidence, diminishing organization’s sales, net worth, and reputation. • Threat of hacktivist or cyberactivist operations is rising. • Cyberterrorism/Cyberwarfare: a much more sinister form of hacking Principles of Information Security, Fifth Edition 25
- 26. Principles of Information Security, Fifth Edition 26