"Information security refers to the processes and methodologies that are designed to protect sensitive information or data from unauthorized access, use and misuse, disclosure, modification, destruction, or disruption" - introduction
External Threats
Human
Network Security
Physical Security
Communication Security
Software
Social & economic
Legal
Internal threats
Human
Fraud/misuse
Espionage
Social Engineering
Infrastructure
Layers of Protection
Physical: secured access, asset control, fire protection
Access Control: clear authentication and authorization
Application: effective control over web servers, databases and applications
Network: Firewalls, IDS/IPS
Host/Platform Security: Host IDS/IPS, anti-virus, hardening of servers
"defense-in-depth"
builds over layered security
Adds additional mechanisms for monitoring, alerting and emergency response
SABSA(business focused)
Open, generic, scalable methodology for information security
Six layers, five vertical layers
Service Security Management Architecture Layer(Horizontal Layer): Service delivery management
Contextual: Business users provide business requirements
Conceptual: Architect provides overall context to the business requirements
Logical: Designers provide system engineers with model viewing business as a system
Physical: Builder provides physical security
Component Security: tradesmen work on specifications given by the builder and work with specialist and system components
Pillars of security
People: strongest and weakest pillars of information security
Organization of Information Security: In an organization, everybody down the line should be involved in information security
The Need for Independence: Technology is usually headed by a ChiefTechnology Officer or Chief Information Officer who is supported by IT managers and operation staff. However, it's important to watch for conflicts of interest that would lead to security vulnerabilities
CIA Triad
Confidentiality: Information that is secret or sensitive should remain that way
Integrity: Information should not be manipulated or changed
Availability: Information should be available as it is needed