Introduction to Information Security

Chapter 1
DO NOT FIGURE ON OPPONENTS NOT
ATTACKING; WORRY ABOUT YOUR OWN
LACK OF PREPARATION.
-- BOOK OF THE FIVE RINGS

Learning Objectives:
Slide
2

Upon completion of this chapter you should be

able to:
Understand what information security is and how it came
to mean what it does today.
Comprehend the history of computer security and how it
evolved into information security.
Understand the key terms and critical concepts of
information security as presented in the chapter.
Outline the phases of the security systems development
life cycle.
Understand the role professionals involved in
information security in an organizational structure.

Principles of Information Security - Chapter 1

What Is Information Security?

Slide
3

Information security in todays enterprise is a wellinformed sense of assurance that the information
risks and controls are in balance. Jim Anderson,
Inovant (2002)

Principles of Information Security - Chapter 1

The History Of Information Security

Slide
4

Computer security began immediately after the first

mainframes were developed

Groups developing code-breaking computations during
World War II created the first modern computers
Physical controls were needed to limit access to
authorized personnel to sensitive military locations
Only rudimentary controls were available to defend
against physical theft, espionage, and sabotage

Principles of Information Security - Chapter 1

Figure 1-1 The Enigma

Slide
5

Principles of Information Security - Chapter 1

The 1960s
Slide
6

Department of Defenses Advanced Research Project

Agency (ARPA) began examining the feasibility of a

redundant networked communications
Larry Roberts developed the project from its
inception

Principles of Information Security - Chapter 1

Figure 1-2 - ARPANET

Slide
7

Principles of Information Security - Chapter 1

The 1970s and 80s

Slide
8

ARPANET grew in popularity as did its potential

for misuse
Fundamental problems with ARPANET security
were identified
No safety procedures for dial-up connections to the
ARPANET
User identification and authorization to the system were
non-existent
In the late 1970s the microprocessor expanded

computing capabilities and security threats

Principles of Information Security - Chapter 1

R-609 The Start of the Study of

Computer Security
Slide
9

Information Security began with Rand Report R-

609
The scope of computer security grew from physical
security to include:

Safety of the data

Limiting unauthorized access to that data
Involvement of personnel from multiple levels of the
organization

Principles of Information Security - Chapter 1

The 1990s
Slide
10

Networks of computers became more common, so

too did the need to interconnect the networks

Resulted in the Internet, the first manifestation of a
global network of networks
In early Internet deployments, security was treated
as a low priority

Principles of Information Security - Chapter 1

The Present
Slide
11

The Internet has brought millions of computer

networks into communication with each other

many of them unsecured
Ability to secure each now influenced by the security
on every computer to which it is connected

Principles of Information Security - Chapter 1

What Is Security?
Slid
e 12

The quality or state of being secure--to be free

from danger
To be protected from adversaries
A successful organization should have multiple
layers of security in place:
Physical security
Personal security
Operations security
Communications security
Network security

Principles of Information Security - Chapter 1

What Is Information Security?

Slid
e 13

The protection of information and its critical

elements, including the systems and hardware that

use, store, and transmit that information
Tools, such as policy, awareness, training,
education, and technology are necessary
The C.I.A. triangle was the standard based on
confidentiality, integrity, and availability
The C.I.A. triangle has expanded into a list of
critical characteristics of information
Principles of Information Security - Chapter 1

Critical Characteristics Of Information

Slid
e 14

The value of information comes from the

characteristics it possesses.

Availability
Accuracy
Authenticity
Confidentiality
Integrity
Utility
Possession

Principles of Information Security - Chapter 1

Figure 1-3 NSTISSC Security Model

Slid
e 15

Principles of Information Security - Chapter 1

Components of an Information System

Slid
e 16

To fully understand the importance of

information security, you need to know the

elements of an information system
An Information System (IS) is much more than

computer hardware; it is the entire set of

software, hardware, data, people, and
procedures necessary to use information as a
resource in the organization
Principles of Information Security - Chapter 1

Securing the Components

Slid
e 17

The computer can be either or both the subject of an

attack and/or the object of an attack

When a computer is

the subject of an attack, it is used as an active tool to conduct

the attack
the object of an attack, it is the entity being attacked

Principles of Information Security - Chapter 1

Figure 1-5 Subject and Object of Attack

Slid
e 18

Principles of Information Security - Chapter 1

Balancing Security and

Slid Access
e 19

It is impossible to obtain perfect security - it is not

an absolute; it is a process
Security should be considered a balance between
protection and availability
To achieve balance, the level of security must allow
reasonable access, yet protect against threats

Principles of Information Security - Chapter 1

Figure 1-6 Balancing Security and Access

Slid
e 20

Principles of Information Security - Chapter 1

Bottom Up Approach
Slid
e 21

Security from a grass-roots effort - systems

administrators attempt to improve the security of

their systems
Key advantage - technical expertise of the individual
administrators
Seldom works, as it lacks a number of critical
features:

participant support
organizational staying power

Principles of Information Security - Chapter 1

Figure 1-7 Approaches to Security

Implementation
Slid
e 22

Principles of Information Security - Chapter 1

Top-down Approach
Slid
e 23

Initiated by upper management:

issue policy, procedures, and processes
dictate the goals and expected outcomes of the project
determine who is accountable for each of the required actions
This approach has strong upper management

support, a dedicated champion, dedicated funding,

clear planning, and the chance to influence
organizational culture
May also involve a formal development strategy
referred to as a systems development life cycle

Most successful top-down approach

Principles of Information Security - Chapter 1

The Systems Development Life Cycle

Slid
e 24

Information security must be managed in a manner

similar to any other major system implemented in

the organization
Using a methodology

ensures a rigorous process

avoids missing steps

The goal is creating a comprehensive security

posture/program

Principles of Information Security - Chapter 1

Figure 1-8 SDLC Waterfall Methodology

Slid
e 25

Principles of Information Security - Chapter 1

SDLC and the SecSDLC

The SecSDLC may be

Slid
e 26

event-driven - started in response to some occurrence or

plan-driven - as a result of a carefully developed
implementation strategy

At the end of each phase comes a structured review

Principles of Information Security - Chapter 1

Investigation
Slid
e 27

What is the problem the system is being developed

to solve?

The objectives, constraints, and scope of the project are

specified
A preliminary cost/benefit analysis is developed
A feasibility analysis is performed to assesses the economic,
technical, and behavioral feasibilities of the process

Principles of Information Security - Chapter 1

Analysis
Slid
e 28

Consists primarily of

assessments of the organization

the status of current systems
capability to support the proposed systems

Analysts begin to determine

what the new system is expected to do

how the new system will interact with existing systems

Ends with the documentation of the findings and

a feasibility analysis update

Principles of Information Security - Chapter 1

Logical Design
Slid
e 29

Based on business need, applications are selected

capable of providing needed services

Based on applications needed, data support and
structures capable of providing the needed inputs
are identified
Finally, based on all of the above, select specific
ways to implement the physical solution are
chosen
At the end, another feasibility analysis is
performed
Principles of Information Security - Chapter 1

Physical Design
Slid
e 30

Specific technologies are selected to support the

alternatives identified and evaluated in the logical

design
Selected components are evaluated based on a makeor-buy decision
Entire solution is presented to the end-user
representatives for approval

Principles of Information Security - Chapter 1

Implementation
Slid
e 31

Components are ordered, received, assembled, and

tested
Users are trained and documentation created
Users are then presented with the system for a
performance review and acceptance test

Principles of Information Security - Chapter 1

Maintenance and Change

Slid
e 32

Tasks necessary to support and modify the system

for the remainder of its useful life

The life cycle continues until the process begins
again from the investigation phase
When the current system can no longer support the
mission of the organization, a new project is
implemented

Principles of Information Security - Chapter 1

Security Systems
Development Life Cycle
Slid
e 33

The same phases used in the traditional SDLC

adapted to support the specialized implementation

of a security project
Basic process is identification of threats and
controls to counter them
The SecSDLC is a coherent program rather than a
series of random, seemingly unconnected actions

Principles of Information Security - Chapter 1

Investigation
Slid
e 34

Identifies process, outcomes and goals of the project,

and constraints
Begins with a statement of program security policy
Teams are organized, problems analyzed, and scope
defined, including objectives, and constraints not
covered in the program policy
An organizational feasibility analysis is performed

Principles of Information Security - Chapter 1

Analysis
Slid
e 35

Analysis of existing security policies or programs,

along with documented current threats and

associated controls
Includes an analysis of relevant legal issues that
could impact the design of the security solution
The risk management task (identifying, assessing,
and evaluating the levels of risk) also begins

Principles of Information Security - Chapter 1

Logical & Physical Design

Slid
e 36

Creates blueprints for security

Critical planning and feasibility analyses to

determine whether or not the project should

continue
In physical design, security technology is
evaluated, alternatives generated, and final
design selected
At end of phase, feasibility study determines
readiness so all parties involved have a chance to
approve the project
Principles of Information Security - Chapter 1

Implementation
Slid
e 37

The security solutions are acquired (made or

bought), tested, and implemented, and tested again

Personnel issues are evaluated and specific training
and education programs conducted
Finally, the entire tested package is presented to
upper management for final approval

Principles of Information Security - Chapter 1

Maintenance and Change

Slid
e 38

The maintenance and change phase is perhaps most

important, given the high level of ingenuity in

todays threats
The reparation and restoration of information is a
constant duel with an often unseen adversary
As new threats emerge and old threats evolve, the
information security profile of an organization
requires constant adaptation

Principles of Information Security - Chapter 1

Security Professionals and the Organization

Slid
e 39

It takes a wide range of professionals to support a

diverse information security program

To develop and execute specific security policies
and procedures, additional administrative support
and technical expertise is required

Principles of Information Security - Chapter 1

Senior Management
Slid
e 40

Chief Information Officer

the senior technology officer

primarily responsible for advising the senior executive(s)
for strategic planning
Chief Information Security Officer

responsible for the assessment, management, and

implementation of securing the information in the
organization
may also be referred to as the Manager for Security, the
Security Administrator, or a similar title

Principles of Information Security - Chapter 1

Security Project Team

Slid
e 41

A number of individuals who are experienced in

one or multiple requirements of both the technical
and non-technical areas:
The champion
The team leader
Security policy developers
Risk assessment specialists
Security professionals
Systems administrators
End users

Principles of Information Security - Chapter 1

Data Ownership
Slid
e 42

Data Owner - responsible for the security and use of

a particular set of information

Data Custodian - responsible for the storage,
maintenance, and protection of the information
Data Users - the end systems users who work with
the information to perform their daily jobs
supporting the mission of the organization

Principles of Information Security - Chapter 1

Communities Of Interest
Slid
e 43

Each organization develops and maintains its own

unique culture and values. Within that corporate

culture, there are communities of interest:

Information Security Management and Professionals

Information Technology Management and Professionals
Organizational Management and Professionals

Principles of Information Security - Chapter 1

Information Security: Is It an Art or a

Science?
Slid
e 44

With the level of complexity in todays information

systems, the implementation of information

security has often been described as a combination
of art and science

Principles of Information Security - Chapter 1

Security as Art
Slid
e 45

No hard and fast rules nor are there many

universally accepted complete solutions

No magic users manual for the security of the entire
system
Complex levels of interaction between users, policy,
and technology controls

Principles of Information Security - Chapter 1

Security as Science
Slid
e 46

Dealing with technology designed to perform at high

levels of performance
Specific conditions cause virtually all actions that
occur in computer systems
Almost every fault, security hole, and systems
malfunction is a result of the interaction of specific
hardware and software
If the developers had sufficient time, they could
resolve and eliminate these faults

Principles of Information Security - Chapter 1

Security as a Social Science

Slid
e 47

Social science examines the behavior of individuals

interacting with systems

Security begins and ends with the people that
interact with the system
End users may be the weakest link in the security
chain
Security administrators can greatly reduce the levels
of risk caused by end users, and create more
acceptable and supportable security profiles

Principles of Information Security - Chapter 1