Professional Documents
Culture Documents
Session 1 - Information System Security Over View
Session 1 - Information System Security Over View
OVERVIEW
Introduction
Information system is an integrated set of components for collecting, storing, and
processing and communicating data, knowledge, and digital products. Business
firms and other organizations rely on information systems to carry out and
manage their operations, interact with their customers and suppliers, and compete
in the marketplace. Public institutions use information systems in gathering data
from stakeholders and delivering information to them.
Security
Security is the degree of resistance to, or protection from, harm. It applies to any
vulnerable and valuable asset, such as a person, dwelling, community, nation, or
organization. Security provides a form of protection where a separation is created
between the assets and the threat. It is implemented through policies and
procedures. A security policy is a document that outlines the rules, laws and
practices for asset access. Such document regulates how an organization will
manage and protect assets.
Information System Security
Information systems security is the practice of defending information from
unauthorized access, use, disclosure, disruption, modification, perusal, inspection,
recording or destruction. It is a general term that can be used regardless of the
form the data may take.
2
the evolving environment. The currently relevant set of security goals may
include: confidentiality, integrity, availability, privacy, authenticity &
trustworthiness, non-repudiation, accountability and auditability."
The current tendency towards using information systems which are increasingly
bigger and are distributed throughout the entire globe through the Internet has led
to the present-day information systems being vulnerable to a host of threats and
cyberattacks by cyber-terrorists, hackers using such programmes as virus which
are propagated through the Internet, social engineering attacks (phishing etc.) or
the inappropriate use of the Net’s assets by companies’ employees. The security in
computing has in fact grown tremendously since the 1970s, leading to a huge
number of techniques, models, protocols, etc. These have also been accompanied
by a notable amount of activity on the part of international organisations with
regard to standardisation and certification. This has taken place to such a great
extent that it is possible to find numerous international standardization
organizations that have created a complex structure of standards regarding
themes related to information security, which are frequently altered and updated.
The permanent and global nature of security threats and the increasing complexity
of IT infrastructures are currently leading organizations throughout the world to
revise their approaches towards information security. Hiring the ICT’s
(Information and Communication Technologies) equivalent of military men, i.e.
3
security technologists and white-hat hackers, and entrusting security to them is no
longer sufficient.
4
Security in Small and Medium Enterprises; Privacy; Security and privacy in the
Cloud and Internet; Security metrics; Forensics; Security standards.
Cryptography
The rapid growth of electronic means of communication signifies that information
security has become a crucial issue in the real world. Modern cryptography
provides fundamental techniques with which to secure communication and
information. Cryptographic protocols such as digital signatures, commitment
schemes, oblivious transfer schemes and zero-knowledge proof systems have
contributed towards the construction of various security systems. There are many
works that cover such topics as block ciphers, block modes, hash functions,
encryption modes, signatures, message authentication codes, and implementation.
Privacy
From a trust perspective, it is important for enterprises to ensure that they act in a
privacy conscious manner when accessing and working with an individual’s
personal information or personal identifiable information (PII). Privacy is already
a prime concern in today’s information society. The challenge now is to design
pervasive computing systems that include effective privacy protection
5
mechanisms. The controls focus on information privacy as a value that is different
from, but is highly interrelated with, information security. Organizations cannot
have effective privacy without a solid foundation of information security. However,
privacy is more than security and confidentiality, and also includes the principles
of, for example, transparency, notice and choice.
Security Metrics
A widely accepted management principle is that an activity cannot be managed if it
cannot be measured. Security falls into this rubric. Metrics may be an effective tool
which will allow security managers to discern the effectiveness of various
components of their security programs, the security of a specific system, product
or process, and the ability of staff or departments within an organization to
address security issues for which they are responsible. Metrics can also help to
identify the level of risk involved in not carrying out a given action, and thus
provide guidance in prioritizing corrective actions. Information security metrics
are seen as an important factor in making sound decisions about various aspects of
security, ranging from the design of security architectures and controls to the
effectiveness and efficiency of security operations.
Forensics
The field of computer forensic science emerged as an opponent to the growth of
computer crimes. Digital forensics is defined as a scientifically proven method for
6
the investigation of computers and other digital devices believed to be involved in
criminal activities. A digital forensic investigation should follow proper digital
forensic procedures or process models for its evidence to be admissible in a court
of law. Work in digital forensics covers a wide variety of areas such as law
enforcement needs to produce the compelling and legally recognized evidence
required to prosecute crimes; corporations might need to identify and mitigate an
insider threat, thus requiring a lower standard of proof; and military intelligence
needs might require quick action based on a limited amount of information.
Current solutions for computer forensics are presented in, which are only used to
collect, analyze and extract evidence after intrusions, and some are inspired by the
theory of artificial immune systems. Prevalent forensic techniques do not scale,
and the demand for forensic examination is already much greater than current
capacity.
Security standards
Securing information system resources is extremely important in ensuring that the
resources are well protected. Information security is not just a simple matter of
having usernames and passwords. Regulations and various privacy /data
protection policies impose a raft of obligations. Some proposals for information
security management already exist (ISO/IEC27001 [ISO/IEC27001 2005], ISM3
[ISM3 2007], BS 7799, PCIDSS, ITIL, all of them created by international
organizations for standardization. The protection of personal data takes on a
particularly special relevance in sectors such as the health, in which the
vulnerabilities of patients’ personal data are extremely important.