190 likes | 868 Views
IS3350 Security Issues in Legal Context. Unit 1 Information Systems Security Overview. Learning Objective. Recognize the legal aspects of the information security triad: Availability Integrity Confidentiality. Key Concepts. Availability, Integrity, and Confidentiality (AIC Triad)
E N D
IS3350 Security Issues in Legal Context Unit 1 Information Systems Security Overview
Learning Objective Recognize the legal aspects of the information security triad: • Availability • Integrity • Confidentiality
Key Concepts • Availability, Integrity, and Confidentiality (AIC Triad) • Basic information system security concepts • Risk analysis and mitigation • Mechanisms for organizational information security • Data classifications requiring specialized legal consideration
CIA Triad Confidentiality Information Security Integrity Availability
Information Security Common Concerns • Shoulder Surfing • Social Engineering • Spear Phishing • Malware • Spyware • Logic Bomb • Back Door Denial of Service
Legal Mechanisms to Ensure Information Security • Laws • Gramm-Leach-Bliley Act, HIPPA, Sarbanes-Oxley (SOX), and others • Information Regulations • Financial, credit card, health, etc. • Agencies • FTC, Banks, DHHS, SEC, DOE, etc.
Risk Management Concepts • Vulnerability ~ asset weaknesses • Mitigation ~ safeguard assets • Threat Agent ~ hacker or malware • Exploits ~ threats carried out • Risks ~ minimized by asset owner
Owner Safeguard Vulnerability Threat Agent Risk Threat Asset Risk Management Process
Roles in Risk Management Senior Management Chief Information Security Officer Information Technology Department Legal Department
Access Control Models • Discretionary Access Control (DAC): • discretion of the owner • Mandatory Access Control (MAC): • security labels & classifications • Role-Based Access Control (RBAC): • job function or role
Law and Information Security • Cyberspace theft • Internet extortion • Online pedophilia • Jurisdiction issues • Electronic signature issues
Summary • Availability, Integrity, and Confidentiality (AIC Triad) • Basic information system security concepts • Risk analysis and mitigation • Mechanisms for organizational information security • Data classifications requiring specialized legal consideration