Professional Documents
Culture Documents
Romney Ais13 PPT 08
Romney Ais13 PPT 08
Security
Chapter 8
8-1
Learning Objectives
Explain how information security affects
information systems reliability.
Discuss how a combination of preventive,
detective, and corrective controls can be
employed to provide reasonable assurance about
the security of an organizations information
system.
Copyright 2015 Pearson Education, Inc.
8-2
Confidentiality
Sensitive organizational data is protected.
Privacy
Personal information about trading partners, investors, and
employees are protected.
Processing integrity
Data are processed accurately, completely, in a timely
manner, and only with proper authorization.
Availability
System and information are available.
8-3
8-4
8-5
Security Approaches
Defense-in-depth
Multiple layers of control (preventive and
detective) to avoid a single point of failure
8-6
Detective Controls
Log analysis
Intrusion detection
systems
Penetration testing
Continuous
monitoring
8-7
Preventive: People
Culture of security
Tone set at the top with management
Training
Follow safe computing practices
8-8
Preventive: Process
Authenticationverifies the person
1. Something person knows
2. Something person has
3. Some biometric characteristic
4. Combination of all three
8-9
Preventive: IT Solutions
Antimalware controls
Network access controls
Device and software hardening controls
Encryption
8-10
Preventive: Other
Physical security access controls
Limit entry to building
Restrict access to network and data
8-11
Corrective
Computer Incident Response Team (CIRT)
Chief Information Security Officer (CISO)
Patch management
8-12
Key Terms
Defense-in-depth
Time-based model of security
Social engineering
Authentication
Biometric identifier
Multifactor authentication
Multimodal authentication
Authorization
Access control matrix
Compatibility test
Border router
Firewall
Demilitarized zone (DMZ)
Routers
8-14