Computer Security and Reliability Chapter 1: Information Security Fundamentals Dr. Hoá NGUYEN College of Technology, Vietnam National University, Hanoi 13/10/2008
[email protected]
Objectives
Identify the challenges for information security
Define information security
Explain the importance of information security
List and define information security terminology
Describe the CompTIA Security+ certification exam
Describe information security careers
Computer Security & Reliability
2
Identifying the Challenges for Information Security
Challenge of keeping networks and computers secure has never been greater
A number of trends illustrate why security is becoming increasingly difficult
Many trends have resulted in security attacks growing at an alarming rate
Computer Security & Reliability
3
Identifying the Challenges for Information Security (continued)
Computer Emergency Response Team (CERT) security organization compiles statistics regarding number of reported attacks, including: Speed of attacks Sophistication of attacks Faster detection of weaknesses Distributed attacks Difficulties of patching
Computer Security & Reliability
4
Identifying the Challenges for Information Security (continued)
Computer Security & Reliability
5
Identifying the Challenges for Information Security (continued)
Computer Security & Reliability
6
Defining Information Security
Information security: Tasks of guarding digital information, which is typically
processed by a computer (such as a personal computer), stored on a magnetic or optical storage device (such as a hard drive or DVD), and transmitted over a network spacing
Ensures that protective measures are properly implemented Is intended to protect information Involves more than protecting the information itself
Computer Security & Reliability
7
Defining Information Security (continued)
Computer Security & Reliability
8
Defining Information Security (continued)
Three characteristics of information must be protected by information security:
Confidentiality Integrity Availability
Center of diagram shows what needs to be protected (information) Information security achieved through a combination of three entities
Computer Security & Reliability
9
Understanding the Importance of Information Security
Information security is important to businesses: Prevents data theft Avoids legal consequences of not securing information Maintains productivity Foils cyberterrorism Thwarts identity theft
Computer Security & Reliability
10
Preventing Data Theft
Security often associated with theft prevention Drivers install security systems on their cars to prevent the cars from being stolen Same is true with information security―businesses cite preventing data theft as primary goal of information security
Computer Security & Reliability
11
Preventing Data Theft (continued)
Theft of data is single largest cause of financial loss due to a security breach One of the most important objectives of information security is to protect important business and personal data from theft
Computer Security & Reliability
12
Avoiding Legal Consequences
Businesses that fail to protect data may face serious penalties Laws include: The Health Insurance Portability and Accountability Act of
1996 (HIPAA) The Sarbanes‐Oxley Act of 2002 (Sarbox) The Cramm‐Leach‐Blilely Act (GLBA) USA PATRIOT Act 2001
Computer Security & Reliability
13
Maintaining Productivity
After an attack on information security, clean‐up efforts divert resources, such as time and money away from normal activities A Corporate IT Forum survey of major corporations showed: Each attack costs a company an average of $213,000 in lost
man‐hours and related costs One‐third of corporations reported an average of more than 3,000 man‐hours lost
Computer Security & Reliability
14
Maintaining Productivity (continued)
Computer Security & Reliability
15
Foiling Cyberterrorism
An area of growing concern among defense experts are surprise attacks by terrorist groups using computer technology and the Internet (cyberterrorism) These attacks could cripple a nation’s electronic and commercial infrastructure Our challenge in combating cyberterrorism is that many prime targets are not owned and managed by the federal government
Computer Security & Reliability
16
Thwarting Identity Theft
Identity theft involves using someone’s personal information, such as social security numbers, to establish bank or credit card accounts that are then left unpaid, leaving the victim with the debts and ruining their credit rating National, state, and local legislation continues to be enacted to deal with this growing problem The Fair and Accurate Credit Transactions Act of 2003 is a
federal law that addresses identity theft
Computer Security & Reliability
17
Understanding Information Security Terminology
Computer Security & Reliability
18
Exploring the CompTIA Security+ Certification Exam
Since 1982, the Computing Technology Industry Association (CompTIA) has been working to advance the growth of the IT industry CompTIA is the world’s largest developer of vendor‐ neutral IT certification exams The CompTIA Security+ certification tests for mastery in security concepts and practices
Computer Security & Reliability
19
Exploring the CompTIA Security+ Certification Exam (continued)
Exam was designed with input from security industry leaders, such as VeriSign, Symantec, RSA Security, Microsoft, Sun, IBM, Novell, and Motorola The Security+ exam is designed to cover a broad range of security topics categorized into five areas or domains
Computer Security & Reliability
20
Surveying Information Security Careers
Information security is one of the fastest growing career fields As information attacks increase, companies are becoming more aware of their vulnerabilities and are looking for ways to reduce their risks and liabilities
Computer Security & Reliability
21
Surveying Information Security Careers (continued)
Sometimes divided into three general roles: Security manager develops corporate security plans and
policies, provides education and awareness, and communicates with executive management about security issues Security engineer designs, builds, and tests security solutions to meet policies and address business needs Security administrator configures and maintains security solutions to ensure proper service levels and availability
Computer Security & Reliability
22
Summary
The challenge of keeping computers secure is becoming increasingly difficult Attacks can be launched without human intervention and infect millions of computers in a few hours Information security protects the integrity, confidentiality, and availability of information on the devices that store, manipulate, and transmit the information through products, people, and procedures
Computer Security & Reliability
23
Summary (continued)
Information security has its own set of terminology A threat is an event or an action that can defeat security measures and result in a loss CompTIA has been working to advance the growth of the IT industry and those individuals working within it CompTIA is the world’s largest developer of vendor‐ neutral IT certification exams
Computer Security & Reliability
24
