Download Chapter 1 Study Outline

Information Security Basics
1
6/28/2017
Chapter 1 Study Outline
I.
Information Security
A. Information security refers to the measures adopted to prevent the unauthorized
use, misuse, modification, or denial of use of knowledge, facts, data, or
capabilities.
B. Information security involves identifying the threats and vulnerabilities of the
organization and managing them appropriately.
C. Implementing a proper information security system is not a one-time activity. It
requires a constant vigilance against new security threats that might arise.
D. The need to examine the history of security.
E. Changes in technology and society have resulted in the evolution of the various
security concepts of today.
F.
Physical security.
1.
In the early days, man stored information on physical media like stone,
paper etc.
2.
Protection of these physical assets needed physical security measures like
guards, walls, moats, etc.
3.
Information was transmitted as messages delivered by messengers.
G. Communication security.
1.
Communication security evolved as a result of the problem with physical
security.
H. Emissions security.
1.
A new security threat associated with sending encrypted messages over the
phone lines was identified in the 1950’s.
2.
All electronic systems give off electronic emissions and these electronic
signals bypass encryption.
093-2
1-1
Information Security Basics
3.
1
6/28/2017
The original unencrypted signal, found along with the encrypted signal on
the telephone lines, could be recovered with good equipment.
4.
To deal with the issue of emissions security, the United States created a
program called the TEMPEST.
a)
The TEMPEST program created electrical emissions standards for
computer systems used in very sensitive environments.
I.
Computer security.
1.
With the advent of computers, organizations began to store information on
them in electronic format.
2.
The need of computer security arose from the fact that any person with
access to the computer system also got access to the information on it.
3.
If a person had a clearance level that was higher than the classification level
of a file, that person could access the file.
4.
If the person’s clearance level were lower than the file’s classification,
access would be denied.
5.
The Trusted Computing System Evaluation Criteria (TCSEC) or the Orange
Book developed in 1983.
6.
For each division, the Orange Book defined functional requirements as well
as assurance requirements.
7.
Other criteria that attempted to find a method of certifying computer
systems for security while decoupling functionality from assurance
included:
a)
The German Green Book developed in 1989.
b) The Canadian Criteria developed in 1990.
c)
The Information Technology Security Evaluation Criteria (ITSEC)
developed in 1991.
093-2
1-2
Information Security Basics
1
6/28/2017
d) The Federal Criteria (now known as the Common Criteria) developed
in 1992.
8.
Network security.
a)
New security issues arose when computers were networked together.
b) The Orange Book did not address the issue of networked computers.
c)
The Trusted Network Interpretation of the TCSEC (TNI), or the Red
Book developed in 1987 dealt with the issue of network security.
d) The Red Book took all of the requirements of the Orange Book and
attempted to address a networked environment of computers.
e)
J.
The Red Book did cover wireless networks.
Information security as a total security solution.
1.
Good physical security is necessary to protect physical assets like paper
records and systems.
2.
Communication security (COMSEC) is necessary to protect information in
transit.
3.
Emission security (EMSEC) is needed when the enemy has significant
resources to read the electronic emissions from the computer systems.
4.
Computer security (COMPUSEC) is necessary to control access on the
computer systems.
5.
Network security (NETSEC) is needed to control the security of the local
area networks.
K. A good security solution.
1.
A good security solution is a mix of all of the various types of security.
II. Defining Security as a Process
A. Many different products and types of products are necessary to fully protect an
organization’s information assets.
093-2
1-3
Information Security Basics
1
6/28/2017
B. A good security solution would involve implementation of the security products
most suitable for the organizations needs, along with good security practices and
constant vigilance.
C. Some prominent security technologies and product categories.
1.
Anti-virus software.
a)
An anti-virus software that is properly implemented and configured can
reduce an organization’s exposure to malicious programs.
b) An anti-virus software does not protect an organization from:
(1) An intruder who misuses a legitimate program to gain access to a
system.
(2) Legitimate users who attempt to gain access to files that they
should not have access to.
D. Access controls.
1.
If systems are properly configured and the file permissions set
appropriately, file access controls can restrict legitimate users from
accessing files they should not have access to.
2.
Access controls do not prevent user from using a system vulnerability to
gain access to the system as an administrator and thus see files on the
system.
E. Firewalls
1.
Firewalls are access control devices for the network that assist in protecting
an organization’s internal network from external attacks.
2.
A firewall does not protect an organization’s network if:
a)
The attacker uses an allowed connection to attack a system.
b) The attacker is an internal user.
c)
The attacker hops onto the wireless network and appears as an internal
user.
093-2
1-4
Information Security Basics
F.
1
6/28/2017
Smart cards.
1.
Passwords are the most commonly used authentication mechanisms.
2.
Smart cards are another authentication mechanism.
a)
They reduce the risk of someone guessing a password.
b) If a smart card is stolen and if it is the sole form of authentication, the
thief could masquerade as a legitimate user of the network or computer
system.
c)
Another issue with this authentication mechanism is its high cost.
G. Biometrics
1.
Biometric systems are another authentication mechanism that reduces the
risk of someone guessing a password.
2.
Biometric systems involve scanning of some human characteristic such as
fingerprints or retina as a method of identification.
3.
Issues that arise with the use of biometrics include the cost of deploying the
biometric scanners and the willingness of staff to use them.
4.
Biometric systems can also fail: an attacker may force an authentic user to
use the biometric scanner and thus gain entry to the system.
H. Intrusion detection.
1.
Intrusion detection involves identifying unauthorized access to the system
and stopping them.
2.
Intrusion detection systems by themselves cannot be the solution to the
entire security problem.
a)
No intrusion detection system is foolproof, and they cannot replace a
good security program or good security practice.
I.
Policy management.
1.
With a policy management system, an organization can be made aware of
any system that does not conform to policy.
093-2
1-5
Information Security Basics
2.
1
6/28/2017
Policy management cannot prevent attacks that may occur due to:
a)
Vulnerabilities in systems.
b) Misconfigurations in application software.
c)
J.
Stolen passwords.
Vulnerability scanning.
1.
Scanning computer systems for weaknesses in configurations or patch
levels will help an organization identify potential entry points for intruders.
2.
Vulnerability scanning alone will not protect your computer systems.
a)
Vulnerability scanning will not detect:
(1) Legitimate users who may have inappropriate access.
(2) An intruder who is already in the system.
3.
Security measures must be implemented immediately after each
vulnerability is identified.
K. Encryption
1.
Encryption protects:
a)
Information in transit.
b) Information in storage by the encryption of files.
2.
Encryption by itself will not provide security.
a)
The encryption system will not differentiate between legitimate and
illegitimate users if both present the same keys to the encryption
algorithm.
L. Physical security mechanisms.
1.
Physical security is necessary to provide unauthorized physical access to
information and systems.
093-2
1-6
Information Security Basics
2.
1
6/28/2017
Physical security will not protect the systems from attacks that use
legitimate access or attacks that come across the network instead of through
the front door.
093-2
1-7