Introduction to Cyber Security and Information Assurance

1. Introduction to Cyber Security and Information Assurance Center of Excellence for IT at Bellevue College

2. Cyber security and information assurance refer to measures for protecting computer systems, networks, and information systems from disruption or unauthorized access, use, disclosure, modification, or destruction.

3. Cyber Security and Information Assurance • Cyber security often refers to safety of the infrastructure and computer systems with a strong emphasis on the technology • Information assurance tends to have a boarder focus with emphasis on information management and business practices • The two areas overlap strongly and the terms are sometimes used interchangeably

4. Information assurance (IA) is the practice of managing information-related risks. More specifically, IA practitioners seek to protect and defend information and information systems by ensuring confidentiality, data integrity, authentication, availability, and non-repudiation. IA measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.

5. Confidentiality Confidentiality has been defined by the International Organization for Standardization (ISO) as "ensuring that information is accessible only to those authorized to have access" and is one of the cornerstones of information security. Confidentiality is one of the design goals for many cryptosystems, made possible in practice by the techniques of modern cryptography.

6. Data Integrity Data integrity means that the data is "whole" or complete, and is identically maintained during any operation (such as transfer, storage or retrieval). Data integrity is the assurance that data is consistent and correct. Loss of integrity can result from: • Malicious altering, such as an attacker altering an account number in a bank transaction, or forgery of an identity document • Accidental altering, such as a transmission error, or a hard disk crash

7. Authentication Authentication is a security measure designed to establish the validity of a transmission, message, document or originator, or a means of verifying an individual's authorization to receive specific categories of information. Authentication technologies include: • passwords, digital signatures, keys and passports, biometrics

8. Availability Availability means that the information, the computing systems used to process the information, and the security controls used to protect the information are all available and functioning correctly when the information is needed = timely, reliable access to data and information services for authorized users.

9. Nonrepudation Non-repudiation is the assurance the sender of data is provided with proof of delivery and the recipient is provided with proof of the sender's identity, so neither can later deny having processed the data. Technologies include: • Digital certificates and signatures

10. Some Global Trends • The global recession will lead to a rise of cybercrime worldwide according to 2009 cybercrime forecasts from leading IT security firms. • Approximately 1.5 million pieces of unique malware will have been identified by the end of the year, more than in the previous five years combined. • The optimal way to prevent malicious files from infecting PCs and corporate networks is active real-time content inspection technologies. www.securitymanagement.com/print/4969

11. US Cyber Security Trends • The United States has bypassed China as the biggest purveyor of malware as well as sends the most spam worldwide, says Sophos Security Threat Report: 2009. • Not only is the USA relaying the most spam because too many of its computers have been compromised and are under the control of hackers, but it's also carrying the most malicious webpages. www.securitymanagement.com/print/4969

12. Web 2.0 and Cyber Security • Cybercriminals will continue to exploit the best Web 2.0 technologies, such as Trojan technologies. • Cybercriminals are increasingly relying on Adobe PDF and Flash files, normally considered safe, to infect victims with malware. • Hackers have been breaking into Facebook and MySpace and implanting malware to distribute to a victim's social network. www.securitymanagement.com/print/4969

13. Trends in Technology • Increasing complexity of IT systems and networks • Convergence of IT and communication systems • Expanding wireless connectivity and multiplicity of wireless devices • Increasing amount of digital information collected • Increasing connectivity and accessibility of digital information systems • Globalization of IT and information systems • Increased web access to a wide range of web services and web applications • Increase in all forms of digital commerce • Trends towards data-marts and hosted data warehousing services

14. Areas of Emphasis • Network security • Disaster recovery • Information system security technologies • Wireless system security • Internet security • Legal issues, standards and compliance • Cybercrime • Information management • Information audit and risk analysis • Digital forensics • Secure electronic commerce

15. Technologies • Types of intrusion and intrusion detection systems • Firewalls and access control • Cryptography • Digital certificates • Biometrics • Digital authentication and Public Key Infrastructure (PKI) • Data assurance and disaster recovery

16. Tools • Cryptography systems • Identification and authentication systems • Operating system security • E-commerce security tools and strategies • Firewalls and proxy servers • Anti-malware and anti-spyware technology • Anti-piracy techniques • Network traffic analysis tools

17. Resources • en.wikipedia.org/wiki/Cyber_security • en.wikipedia.org/wiki/Information_assurance • www.cssia.org/ • www.afei.org/news/NCES/NCES_Information_Assurance.pdf • www.nitrd.gov/pubs/csia/csia_federal_plan.pdf • www.sis.uncc.edu/LIISP/slides00/GAIL.pdf • www.cnss.gov/Assets/pdf/cnssi_4009.pdf • www2.cs.uidaho.edu/~oman/CS336_F08_syllabus.pdf • www.coastline.edu/degrees/page.cfm?LinkID=786 • bii.mc.maricopa.edu/degrees/checklists/CCLInformationAssurance5227.pdf