Information security

Information security

• 1.
  MGT417 INFORMATION TECHNOLOGY IN BUSINESS CHAPTER4 Information Security
• 2.
  4.1 Introduction toInformation Security • Security The degree of resistance to, or the protection from harm. • Information Security The practice of defending information from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. • Threat something that can cause damage or danger. • Exposure something that allows access to information or capabilities that can be used by a hacker as a stepping-stone into a system or network. • Vulnerability The mistake in software that can be directly used by a hacker to gain access to a system or network.
• 3.
  Five Factors Contributingto Vulnerability – Today’s interconnected, interdependent, wirelessly networked business environment – Smaller, faster, cheaper computers & storage devices – Decreasing skills necessary to be a computer hacker – International organized crime taking over cybercrime – Lack of management support
• 4.
  4.2 Unintentional Threatsto Information Systems • Human Errors • Social Engineering
• 5.
  Common Human Error –Carelessness with Laptops – Carelessness with Computing Devices – Opening Questionable E-mail – Careless Internet Surfing – Poor Password Selection and Use – Carelessness with One’s Office – Carelessness Using Unmanaged Devices – Carelessness with Discarded Equipment – Careless Monitoring of Environmental Hazards
• 6.
  4.3 Deliberate Threatsto Information Systems • Software Attacks • Alien Software • Supervisory Control and Data Acquisition (SCADA) Attacks • Cyberterrorism and Cyberwarfare
• 7.
  • Let's focusmore to the most common threats ; -Software Attacks -Alien Software
• 8.
  Software Attacks • RemoteAttacks Requiring User Action – Virus – Worm – Phishing Attack – Spear Phishing Attack • Denial of Service Attack • Distributed Denial of Service Attack
• 9.
  Software Attacks • RemoteAttacks Needing No User Action – Denial of Service Attack – Distributed Denial of Service Attack • Attacks by a Programmer Developing a System – Trojan Horse
• 10.
  Alien Software • Adware •Spyware – Keyloggers • Spamware • Cookies – Tracking cookies
• 11.
  4.4 What OrganizationsAre Doing to Protect Information Resources • Risk • Risk Analysis • Risk Mitigation
• 12.
  4.5 Information SecurityControls • Physical Controls • Access Controls • Communication Controls • Business Continuity Planning • Information Systems Auditing
• 13.
  Physical Controls • Preventunauthorized individuals from gaining access to a company’s facilities. – Walls – Doors – Fencing – Gates – Locks – Badges – Guards – Alarm systems
• 14.
  Access Controls • Authentication Somethingthat is very important such as password that necessary to access the information. • Authorization
• 15.
  Basic Guidelines forPasswords • difficult to guess. • long rather than short. • They should have uppercase letters, lowercase letters, numbers, and special characters. • not recognizable words. • not the name of anything or anyone familiar, such as family names or names of pets. • not a recognizable string of numbers, such as a Social Security number or a birthday.
• 16.
  Communication Controls • Firewalls •Anti-malware Systems • Whitelisting and Blacklisting • Encryption • Virtual Private Networking • Secure Socket Layer • Employee Monitoring Systems
• 17.
  Business Continuity Planning •Disaster Recovery Plan • Hot Site • Cold Site
• 18.
  Information Systems Auditing •Types of Auditors and Audits • How is Auditing Executed?
• 19.
  let's protect ourinformation