Information Security Management. Introduction. By Yuliana Martirosyan, Based on Bell G. Reggard, Information Security Management. Concepts and Practices.

1. Information Security
Management
Introduction
By Yuliana Martirosyan
Based on Bell G. Reggard, (2010) Information Security
Management. Concepts and Practices.

2. Introduction
People
Network
Activities
TechnologyData
Information Security Management
Introduction to Information Security Management

3. • Introduction
• Layers of personnel around an information resources
Operator
-System-
Security Staff
Security Administrator
System Owner
Information Security Management
Introduction to Information Security Management

4. Information Security Management
• Why Information Security Matters?
• Information drives enterprise business value generation.
• Information is the basis of competitive advantage.
• Assets are very independent.
To protect one asset the whole computing environment should be
protected.
Introduction to Information Security Management

5. Information Security Management
Information Sensitivity Classification
Information sensitivity taxonomy
Introduction to Information Security Management
Information
Sensitivity
Public
Information
Confidential
Information
Internal
Use
Proprietary
Information
Highly
Confidential
Top
Secret

6. Information Security Management
Information Security Governance
Corporate governance has to do with how the board of directors and executive
management run and control a company
IT governance is how technology is used and managed so that it supports business needs.
Information security governance is a coherent system of integrated security components
• products
• personnel
• training
• processes
• policies ...
that exist to ensure that the organization survives and hopefully thrives.
Introduction to Information Security Management

7. The Computing Environment
Security of an information system
Information
System
Security
People security
Technology
Security
Network Security
Security of IS
Activities
Data Security
Information Security Management
Introduction to Information Security Management

8. Security of Various Components in the Computer
Environments
Protecting organization, information system , or any computing environment means
following:
• Personal security to protect people
• Qualification assurance
• Specifications of the job
• Security clearance
• Screening Assurance
• Authorizing of process
• Security Training
• Nondisclosure Agreement
Information Security Management
Introduction to Information Security Management

9. Security of an information system
1. Introduction to Information Security Management
CIA Triad
CIA
Triad
Confidentiality
Integrity
Availability

10. CIA triad suffers from at least 2 drawbacks:
Security Star Model
Confidentiality
Availability
Non-Repudiation
Integrity
Authentication
1. Introduction to Information Security Management
The Security Star

11. Parker’s View of Information Security
Parker’s View of Information Security
• CIA Triad
• Authenticity
• Possession Envelope
• Utility
Possession defines ownership or control of information
Authenticity aims at ensuring that the origin of the transmission is correct and that the
authorship of the transmitted documents is valid
Utility emphasized the usefulness of the information in possession
Information Security Management
Introduction to Information Security Management

12. What is Information Security Management
1. Identify computing environment, define its critically, prioritize its contribution to the
organization’s business-value-generation capabilities;
2. Identify all security risks, assess them, mitigate them by devising a comprehensive risk-
driven security program;
3. Provide continual improvement of the organization’s risk position.
Information Security Management
Introduction to Information Security Management

13. Security Controls
Managerial Controls:
• Risk Assessment
• Planning
• System and Service acquisition
• Certification, accreditation and security assessment
Technical Controls:
• Personnel Security
• Physical and environmental protection
• Contingency planning
• Configuration management
Information Security Management
Introduction to Information Security Management

14. Security Controls
Operational Controls:
• Personnel Security
• Physical and environmental protection
• Contingency planning
• Configuration management
• Maintenance
• System and Information Integrity
• Media Protection
• Incident Response
• Awareness and Training
Information Security Management
Introduction to Information Security Management

15. The NSA Triad for Security Assessment
Assessment - Security Planning for 3 years
Not technical, often qualitative
Doesn’t involve any testing
Collaborative, often shared by users, managers, and owner
Evaluation - How to use technology to support information security
Technical but not invasive
Passive testing required for self study
Collaborative to some extends
Involves diagnostic tools
Involves internal audit
Information Security Management
Introduction to Information Security Management

16. The NSA Triad for Security Assessment
Penetration Testing
Non-collaborative
Technical in nature
Invasive in nature
Involves external audit
Active penetration tests
Risk to compromise the target system exists but has to be avoided
Active assessment expertise is required
Information Security Management
Introduction to Information Security Management