On-Line Meeting 2 October 25, 2016

ROLL CALL

Tonight’s Material

Discussion 1 Anyone have any comments they’d like to share about the ISO 27000-family of standards? For example: What “purpose” is served by these?

Discussion 1 (continued) – Does the “International” nature of the “best practices” in ISO-27001 require the “least common denominator” effect?

Discussion 2 How do the ISO 27000 standards relate to the 8 domains of the Common Body of Knowledge? … or the CIA triad?

Discussion 3 Any comments on the 7 Domains (Reading 1)? User Domain Workstation Domain LAN Domain LAN-to-WAN Domain WAN Domain Remote Access Domain System/Application Domain

Discussion 4 Any comments on the presentation of the concepts from Reading 1? Roles and Tasks Responsibilities Accountability Behind-the-Scenes Risks, Threats, Vulnerabilities

Discussion 5 Comments on the InfoSec Areas (Reading 2)? Acceptable Use Security Awareness and Training Asset Classification Protection and Access Protocols Asset Management and Operation Identification, Assessment, and Management of Vulnerabilities Identification, Assessment, and Management of Threats

Discussion 6 Comments on the Information Systems Model?

Discussion 7 – Reading 4 Are these 12 principles “widely accepted”? There is no such thing as Absolute Security. The three Security Goals are Confidentiality, Integrity, and Availability Defense in Depth should be the fundamental strategy When left on their own, most people tend to make the worst security decisions. Security depends on two types of requirements: Functional and Assurance Security Through Obscurity is not Security Security = Risk Management The three types of Security Controls are Preventive, Detective, and Responsive Complexity is the Enemy of Security Fear, Uncertainty and Doubt do not work when selling security People, Process, and Technology are ALL needed to adequately secure a system or facility. Open disclosure of Vulnerabilities is good for security

Discussion 8 – Reading 4 There is no such thing as Absolute Security. The three Security Goals are Confidentiality, Integrity, and Availability Defense in Depth should be the fundamental strategy When left on their own, most people tend to make the worst security decisions. Security depends on two types of requirements: Functional and Assurance Security Through Obscurity is not Security Security = Risk Management The three types of Security Controls are Preventive, Detective, and Responsive Complexity is the Enemy of Security Fear, Uncertainty and Doubt do not work when selling security People, Process, and Technology are ALL needed to adequately secure a system or facility. Open disclosure of Vulnerabilities is good for security

Discussion 8 – Reading 4 There is no such thing as Absolute Security. The three Security Goals are Confidentiality, Integrity, and Availability Defense in Depth should be the fundamental strategy When left on their own, most people tend to make the worst security decisions. Security depends on two types of requirements: Functional and Assurance Security Through Obscurity is not Security Security = Risk Management The three types of Security Controls are Preventive, Detective, and Responsive Complexity is the Enemy of Security Fear, Uncertainty and Doubt do not work when selling security People, Process, and Technology are ALL needed to adequately secure a system or facility. Open disclosure of Vulnerabilities is good for security

Discussion 9 – Reading 4 Security Through Obscurity is not Security There is no such thing as Absolute Security. The three Security Goals are Confidentiality, Integrity, and Availability Defense in Depth should be the fundamental strategy When left on their own, most people tend to make the worst security decisions. Security depends on two types of requirements: Functional and Assurance Security Through Obscurity is not Security Security = Risk Management The three types of Security Controls are Preventive, Detective, and Responsive Complexity is the Enemy of Security Fear, Uncertainty and Doubt do not work when selling security People, Process, and Technology are ALL needed to adequately secure a system or facility. Open disclosure of Vulnerabilities is good for security

Discussion 10 – Reading 4 Complexity is the Enemy of Security There is no such thing as Absolute Security. The three Security Goals are Confidentiality, Integrity, and Availability Defense in Depth should be the fundamental strategy When left on their own, most people tend to make the worst security decisions. Security depends on two types of requirements: Functional and Assurance Security Through Obscurity is not Security Security = Risk Management The three types of Security Controls are Preventive, Detective, and Responsive Complexity is the Enemy of Security Fear, Uncertainty and Doubt do not work when selling security People, Process, and Technology are ALL needed to adequately secure a system or facility. Open disclosure of Vulnerabilities is good for security

Discussion 11 – Reading 4 There is no such thing as Absolute Security. The three Security Goals are Confidentiality, Integrity, and Availability Defense in Depth should be the fundamental strategy When left on their own, most people tend to make the worst security decisions. Security depends on two types of requirements: Functional and Assurance Security Through Obscurity is not Security Security = Risk Management The three types of Security Controls are Preventive, Detective, and Responsive Complexity is the Enemy of Security Fear, Uncertainty and Doubt do not work when selling security People, Process, and Technology are ALL needed to adequately secure a system or facility. Open disclosure of Vulnerabilities is good for security

Theme of Tonight’s Class?

MENTAL MODEL

Notes from an Information Security Lecture Prepare for Next Week Reading 6 Notes from an Information Security Lecture

Prepare for Next Week Notes from an Information Security Lecture Reading 6 Notes from an Information Security Lecture Deep Thought, Pondering, Considering Supplemental Discussion Questions