1 / 29

Chapter 1: Information Security Fundamentals

Chapter 1: Information Security Fundamentals. Security+ Guide to Network Security Fundamentals Second Edition. O bje c t i v e s. Identify the challenges for information security Define information security Explain the importance of information security

mvela
Download Presentation

Chapter 1: Information Security Fundamentals

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Chapter 1: Information Security Fundamentals Security+ Guide to Network Security Fundamentals Second Edition

  2. Objectives • Identify the challenges for informationsecurity • Define informationsecurity • Explain the importance of informationsecurity • List and define information securityterminology • Describe the CompTIA Security+ certificationexam • Describe information securitycareers ’ Security+ Guide to NetworkSecurity Fundamentals,2e

  3. Identifying the Challenges for Information Security (continued) • Computer Emergency Response Team (CERT) security organization compiles statistics regarding number of reported attacks, including: • Speed of attacks • Sophistication of attacks • Faster detection of weaknesses • Distributed attacks • Difficulties of patching ³ Security+ Guide to NetworkSecurity Fundamentals,2e

  4. Identifying the Challenges for Information Security (continued) 9 Security+ Guide to NetworkSecurity Fundamentals,2e

  5. Identifying the Challenges for Information Security (continued) ‘ Security+ Guide to NetworkSecurity Fundamentals,2e

  6. Defining Information Security (continued) • Information security: • – Tasks of guarding digital information, which is typically processed by a computer, stored on a storage device, and transmitted over a network spacing T Security+ Guide to NetworkSecurity Fundamentals,2e

  7. Defining Information Security (continued) • Information security is intended to protect information that has value to people and organizations • This value comes from the characteristics of the information: • Confidentiality • Integrity • Availability • Information security is achieved through a combination of three entities R Security+ Guide to NetworkSecurity Fundamentals,2e

  8. Defining Information Security (continued) • Confidentiality: Prevention of unauthorized disclosure of information. Or keeping unwanted parties from accessing assets of a computer system Also known as: secrecy or privacy • Integrity: Prevention of unauthorized modification of information. • Availability: Prevention of unauthorized withholding of information or resources. Or keeping system available ’t Security+ Guide to NetworkSecurity Fundamentals,2e

  9. Defining Information Security (continued) ’’ Security+ Guide to NetworkSecurity Fundamentals,2e

  10. Defining Information Security (continued) ’’ Security+ Guide to NetworkSecurity Fundamentals,2e

  11. Defining Information Security (continued) • A more comprehensive definition of information security is: • – That which protects the integrity, confidentiality, and availability of information on the devices that store, manipulate, and transmit the information through products, people, and procedures ’‘ Security+ Guide to NetworkSecurity Fundamentals,2e

  12. Understanding the Importance of Information Security • Information security is important tobusinesses: • Prevents datatheft • Avoids legal consequences of not securinginformation • Maintainsproductivity • Foilscyberterrorism • Thwarts identitytheft ’³ Security+ Guide to NetworkSecurity Fundamentals,2e

  13. Preventing DataTheft • Security often associated with theft prevention • Drivers install security systems on their cars to prevent the cars from being stolen • Same is true with information security—businesses cite preventing data theft as primary goal of information security ’9 Security+ Guide to NetworkSecurity Fundamentals,2e

  14. Preventing Data Theft(continued) • Theft of data is single largest cause of financial loss due to a security breach • One of the most important objectives of information security is to protect important business and personal data from theft ’‘ Security+ Guide to NetworkSecurity Fundamentals,2e

  15. Avoiding LegalConsequences • Businesses that fail to protect data may face serious penalties • Laws include: • The Health Insurance Portability and Accountability Act of 1996 (HIPAA) • The Sarbanes-Oxley Act of 2002 (Sarbox) • The Cramm-Leach-Blilely Act (GLBA) • USA PATRIOT Act 2001 ’T Security+ Guide to NetworkSecurity Fundamentals,2e

  16. MaintainingProductivity • After an attack on information security, clean-up efforts divert resources, such as time and money away from normal activities • A Corporate IT Forum survey of major corporations showed: • Each attack costs a company an average of $213,000 in lost man-hours and related costs • One-third of corporations reported an average of more than 3,000 man-hours lost ’M Security+ Guide to NetworkSecurity Fundamentals,2e

  17. Maintaining Productivity(continued) ’R Security+ Guide to NetworkSecurity Fundamentals,2e

  18. FoilingCyberterrorism • An area of growing concern among defense experts are surprise attacks by terrorist groups using computer technology and the Internet (cyberterrorism) • These attacks could cripple a nation’s electronic and commercial infrastructure • Our challenge in combating cyberterrorism is that many prime targets are not owned and managed by the federal government ’t Security+ Guide to NetworkSecurity Fundamentals,2e

  19. Thwarting IdentityTheft • Identity theft involves using someone’s personal information, such as social security numbers, to establish bank or credit card accounts that are then left unpaid, leaving the victim with the debts and ruining their credit rating • National, state, and local legislation continues to be enacted to deal with this growing problem • – The Fair and Accurate Credit Transactions Act of 2003 is a federal law that addresses identity theft ’’ Security+ Guide to NetworkSecurity Fundamentals,2e

  20. Information Security Terminology (continued) • Asset • Something that has a value • Threat • An event or object that may defeat the security measures in place and result in a loss • Threat agent • A person or thing that has the power to carry out a threat ’’ Security+ Guide to NetworkSecurity Fundamentals, ThirdEdition

  21. Information Security Terminology (continued) • Vulnerability • Weakness that allows a threat agent to bypasssecurity • Risk • The likelihood that a threat agent will exploit avulnerability • Realistically, risk cannot ever be entirelyeliminated ’‘ Security+ Guide to NetworkSecurity Fundamentals, ThirdEdition

  22. Information Security Terminology (continued) ’³ Security+ Guide to NetworkSecurity Fundamentals, ThirdEdition

  23. Information Security Terminology (continued) ’9 Security+ Guide to NetworkSecurity Fundamentals, ThirdEdition

  24. Exploring the CompTIA Security+ Certification Exam (continued) • Since 1982, the Computing Technology Industry Association (CompTIA) has been working to advance the growth of the IT industry • CompTIA is the world’s largest developer of vendor- neutral IT certification exams • The CompTIA Security+ certification tests for mastery in security concepts and practices ’‘ Security+ Guide to NetworkSecurity Fundamentals,2e

  25. Exploring the CompTIA Security+ Certification Exam (continued) • The Security+ exam is an internationally recognized validation of foundation-level security skills and knowledge Used by organizations and security professionals around the world • The six domains covered by the Security+ exam: • – Systems Security, Network Infrastructure, Access Control, Assessments and Audits, Cryptography, and Organizational Security ’T Security+ Guide to NetworkSecurity Fundamentals,2e

  26. Surveying Information Security Careers • Information security is one of the fastest growing career fields • As information attacks increase, companies are becoming more aware of their vulnerabilities and are looking for ways to reduce their risks and liabilities ’M Security+ Guide to NetworkSecurity Fundamentals,2e

  27. Surveying Information Security Careers (continued) • Sometimes divided into three general roles: • Security manager develops corporate security plans and policies, provides education and awareness, and communicates with executive management about security issues • Security engineer designs, builds, and tests security solutions to meet policies and address business needs • Security administrator configures and maintains security solutions to ensure proper service levels and availability ’R Security+ Guide to NetworkSecurity Fundamentals,2e

  28. Summary • The challenge of keeping computers secure is becoming increasingly difficult • Attacks can be launched without human intervention and infect millions of computers in a few hours • Information security protects the integrity, confidentiality, and availability of information on the devices that store, manipulate, and transmit the information through products, people, and procedures ‘t Security+ Guide to NetworkSecurity Fundamentals,2e

  29. Summary(continued) • Information security has its own set of terminology • A threat is an event or an action that can defeat security measures and result in a loss • Many organizations use the CompTIA Security+ certification to verify security competency ‘’ Security+ Guide to NetworkSecurity Fundamentals,2e

More Related