1. INFORMATION SECURITY MANAGEMENT

2. Course Outline – Topics Covered
Planning for Security and Contingencies
Information Security Policy
Developing Security Programs
Security Management Models
Risk Management
Identifying
Assessing
Controlling

3. Course Outline – Topics Covered
Protection Mechanism
Personnel and Security
Law and Ethics
Security and the Cloud

4. Classroom Procedures
Most classes will contain the following components:
Current Events
Lectures
Case Studies
Threat Presentations
Encourage student sharing their experiences

5. Course Structure:
Assessments (3) 45% Current Topics/Case Studies/Threats 15% Term paper 20% HealthFirst Case Study Analysis 10% Class Participation/Discussions 10%

6. Current Topics / Threat Predictions
The primary purpose of this assignment is to bring in current topics that are occurring in the world of information security. Choose 1 threat prediction for 2017 to research and present during one of the sessions. See threat predictions link on website and pick 3 possible topics to research and present on. your choices by next Monday, 1/16 These will be assigned next week to be presented throughout the semester.

7. Term Paper
The primary purpose of this assignment is to provide you an opportunity to further develop practical research skills by investigating an information security and information assurance (IA) related topic (hopefully of personal interest).
Consists of:
Paper on the topic (~ 3000 words)
include an annotated bibliography (with at least 12 references)
15-20 minutes presentation of your executive summary to class.
There is a list available in the syllabus. If you want to focus on another topic not listed, let me know.

8. Class Introductions/Expectations
Name Background Course Expectations

9. Who I am Dr. Cummings Assistant Professor at UNCW
Ph.D. in IS (Indiana University)
MBA in IS (Texas Tech University)
Industry experience in networking, programming, project management.

10. Introduction to Information Security Management
Do not figure on opponents not attacking; worry about your own lack of preparation. BOOK OF THE FIVE RINGS

11. Information Security Management
You can have all the protection mechanisms in place and still have security problems:

12. Information Security Management

13. Technology is not enough…
Technology is not enough….. (From: PWC Global State of Information Security 2015)
Even the best technological solutions are being constantly worked on to circumvent.
Essential governance and operational processes:
Incident management response process
Classifying business value of data
Risk assessments on internal systems
Security Audits
Governance, risk and compliance

14. Information Security Management (From: PWC Global State of Information Security 2014)

15. Information Security Management
The goal of this course is to take a step back and examine how security functions as a whole within the organization.
Challenge:
Everything cannot be categorized as right or wrong
What works for one company may fail in another

16. Careers in Information Security
Most studies/reports point to a shortage of security professionals over the next 5 years.
A Cisco 2016 Annual Security Report:
209,000 cybersecurity jobs in the US are unfilled
Postings up 74% over the past 5 years
Cybersecurity market expected to reach $170 billion by 2020

17. CompTIA Security+ Entry-level certification
Requires 2 years experience working in network security
Credential holders possess expertise in knowledge areas such as
Cryptography
Identity management
Security systems
Security risk identification and mitigations
Network access control

18. Certified Information Systems Security Professional
Five years of experience in information security
There are 250 multiple-choice questions
Exam duration: six hours

19. Other Certifications Systems Security Certified Practitioner
Only one year of experience required
Test is 90 minutes long, questions
Certified Ethical Hacker
Certified Information Security Manager

20. Early forms of Information Security
Figure 1-1 The Enigma Source: Courtesy of National Security Agency

21. The 1990s
Networks of computers became more common; so too did the need to interconnect networks Internet became first manifestation of a global network of networks In early Internet deployments, security was treated as a low priority

22. 2000 to Present
The Internet brings millions of computer networks into communication with each other—many of them unsecured Ability to secure a computer’s data influenced by the security of every computer to which it is connected Growing threat of cyber attacks has increased the need for improved security

23. Introduction
The concept of computer security has become synonymous with the concept of information security
Information security is no longer the sole responsibility of a discrete group of people in the company

24. Information Security Decision Makers
1) Information security mgr and professionals
(InfoSec Community)
2) Information technology mgr and professionals
(Information Technology Community)
3) Non-technical business mgr and professionals
(General Business Community)

25. How do you define security? Specialized areas of security
What Is Security?
How do you define security?
Specialized areas of security
Physical
Operations
Communications
Network
Each of these areas contribute to the information security program as a whole

26. What Is Information Security?
How do we achieve Information Security?
Policy
Technology
Training and Awareness Programs
Role of information security is to protect an organization’s information assets

27. Components of an Information System
Information system (IS) is entire set of components necessary to use information as a resource in the organization
Software
Hardware
Data
People
Procedures
Networks

28. Key Information Security Concepts
Protection Profile or Security Posture
Risk
Subjects and Objects
Threat
Threat Agent
Vulnerability
Access
Asset
Attack
Control, Safeguard, or Countermeasure
Exploit
Exposure
Loss

29. Figure 1-1 Components of Information security
Source: Course Technology/Cengage Learning

30. CNSS Security Model (cont’d.)
C.I.A. triangle
Confidentiality, integrity, and availability
Has expanded into a more comprehensive list of critical characteristics of information
NSTISSI (CNSS) Security Model
Provides a more detailed perspective on security
Covers the three dimensions of information security
Primary purpose: identify gaps in the coverage of an information security program

31. CNSS Security Model (cont’d.)
NSTISSC Security Model (cont’d.)
Must address all 27 cells when designing/reviewing a program
Main Purpose: identify gaps in an information security program

32. How to measure the value of information - CIA Triangle
The value of information comes from the characteristics it possesses
Expanded to
include
Identification
Authentication
Authorization
Privacy
Accountability

33. Confidentiality
The characteristic of information whereby only those with sufficient privileges may access certain information
Measures used to protect confidentiality:
Information classification
Secure document storage
Application of general security policies
Education of information custodians and end users

34. Integrity
The quality or state of being whole, complete, and uncorrupted
Threats to information integrity:
Corruption
Damage
Destruction
Other disruption of its authentic state

35. Availability
The characteristic of information that enables user access to information in a required format, without interference or obstruction Availability does not imply that the information is accessible to any user (Implies availability to authorized users)

36. Identification and Authentication
An information system possesses the characteristic of identification when it is able to recognize individual users
Identification and authentication are essential to establishing the level of access or authorization that an individual is granted
Authentication
Occurs when a control proves that a user possesses the identity that he or she claims

37. Authorization
Assures that the user has been specifically and explicitly authorized by the proper authority to access, update, or delete the contents of an information asset Authorization occurs after authentication

38. Privacy
Information collected, used, and stored by an organization is to be used only for the purposes stated to the data owner at the time it was collected
Privacy as a characteristic of information does not signify freedom from observation
Means that information will be used only in ways known to the person providing it

39. Accountability
Exists when a control provides assurance that every activity undertaken can be attributed to a named person or automated process

40. Balancing Information Security and Access
Should everyone have an access button?
Should information be kept in a vault?

41. Balancing Information Security and Access
Functionality
Usability

42. Balancing Information Security and Access
Impossible to obtain perfect security—it is a process, not an absolute Security should be considered balance between protection and availability

43. Security as Art
No hard and fast rules nor many universally accepted complete solutions No manual for implementing security through entire system

44. Security as Science
Dealing with technology designed to operate at high levels of performance Specific conditions cause virtually all actions that occur in computer systems Nearly every fault, security hole, and systems malfunction are a result of interaction of specific hardware and software If developers had sufficient time, they could resolve and eliminate faults

45. Principles of Information Security Management
Include the following characteristics that will be the focus of the current course (six P’s):
Planning
Policy
Programs
Protection
People
Project Management

46. Planning Planning as part of InfoSec management
An extension of the basic planning model discussed earlier in this chapter
Included in the InfoSec planning model
Activities necessary to support the design, creation, and implementation of information security strategies

47. Planning (cont’d.) Types of InfoSec plans Incident response planning
Business continuity planning
Disaster recovery planning
Policy planning
Personnel planning
Technology rollout planning
Risk management planning
Security program planning
includes education, training and awareness

48. Policy
The set of organizational guidelines that dictates certain behavior within the organization
Three general categories of policy:
Enterprise information security policy (EISP)
Issue-specific security policy (ISSP)
System-specific policies (SysSPs)
UNCW Policies

49. Programs
InfoSec operations that are specifically managed as separate entities
Example: a security education training and awareness (SETA) program
Other types of programs
Physical security program
complete with fire, physical access, gates, guards, etc.

50. Protection Executed through risk management activities
Includes:
Risk assessment and control
Protection mechanisms
Technologies
Tools
Each of these mechanisms represents some aspect of the management of specific controls in the overall information security plan

51. The most critical link in the information security program
People
Managers must recognize the crucial role that people play in the information security program
This area of InfoSec includes security personnel and the security of personnel, as well as aspects of a SETA program
The most critical link in the information security program

52. Project Management
Identifying and controlling the resources applied to the project Measuring progress Adjusting the process as progress is made

53. Summary What is security?
Principles of information security management
Planning
Policy
Programs
Protection
People
Project management

54. Next Class Chapter 2 – Planning for Security Signup for Entropy
Lecture Slides and additional readings will be posted in the calendar
Threat Prediction Selections
I will cover discussion of cases and current events next week but read them before class!