1. CSE 4482, Fall 2009, D Chan Session 1 – Introduction to Information Security

2. CSE 4482, Fall 2009, D Chan Security Objectives zConfidentiality (includes privacy) zIntegrity zAvailability

3. CSE 4482, Fall 2009, D Chan Information Security Framework zInformation security policy (what is important, who are accountable and responsible?) zInformation security standards (acceptable levels of security in systems development and operation. zInformation security procedures (how to protect?)

4. CSE 4482, Fall 2009, D Chan Information Security Framework zInformation security infrastructure, firewalls, virtual private network etc. zInformation security software, anti-virus software, access control software, application security etc. zChief information security officer, information security staff.

5. CSE 4482, Fall 2009, D Chan Information Security Framework zInformation classification based on sensitivity. zKeep in mind the objectives of confidentiality, integrity and availability. zInformation ownership.

6. CSE 4482, Fall 2009, D Chan Security Processes zIdentification zAuthentication zAuthorization zLogging zMonitoring

7. CSE 4482, Fall 2009, D Chan Common Security Measures zPassword zTwo-factor authentication zBiometrics zAccess control lists for granting authorization to information zLocks zEncryption zAnti-virus zUsage and rejection reports

8. CSE 4482, Fall 2009, D Chan Passwords zShould not be shared zShould be changed by user zShould be changed frequently and upon compromise (suspected unauthorized disclosure)

9. CSE 4482, Fall 2009, D Chan Passwords zLong, at least 8 characters zAlphanumeric zHashed (one-way scrambling) zSystem should allow only a few attempts before locking out account

10. CSE 4482, Fall 2009, D Chan Passwords zAn 8-letter password is 676 times stronger than a 6-letter password. zA 6-character alphanumeric password is 6 times stronger than a 6-letter password. zStrength should depend on user’s privilege and locality of system.