1. BUSINESS DRIVEN TECHNOLOGY
Business Plug-In B1
Information Security

2. LEARNING OUTCOMES
Describe the relationship between information security policies and an information security plan
Summarize the five steps to creating an information security plan
Provide an example of each of the three primary security areas: (1) authentication and authorization, (2) prevention and resistance, and (3) detection and response
Describe the relationships and differences between hackers and viruses

3. INTRODUCTION
Information security – a broad term encompassing the protection of information from accidental or intentional misuse by persons inside or outside an organization
This plug-in discusses how organizations can implement information security lines of defense through people first and technology second

4. The First Line of Defense - People
Organizations must enable employees, customers, and partners to access information electronically
The biggest issue surrounding information security is not a technical issue, but a people issue
33% of security incidents originate within the organization
Insiders – legitimate users who purposely or accidentally misuse their access to the environment and cause some kind of business-affecting incident

5. The First Line of Defense - People
The first line of defense an organization should follow to help combat insider issues is to develop information security policies and an information security plan
Information security policies – identify the rules required to maintain information security
Information security plan – details how an organization will implement the information security policies

6. The First Line of Defense - People
Five steps to creating an information security plan:
Develop the information security policies
Communicate the information security policies
Identify critical information assets and risks
Firewall – hardware and/or software that guards a private network by analyzing the information leaving and entering the network
Intrusion detection software (IDS) – searches out patterns in network traffic to indicate attacks and quickly respond to prevent harm
Test and reevaluate risks
Obtain stakeholder support

7. The First Line of Defense - People
Hackers frequently use “social engineering” to obtain password
Social engineering – using one’s social skills to trick people into revealing access credentials or other information valuable to the attacker

8. The First Line of Defense - People

9. The Second Line of Defense - Technology
Three primary information security areas:
Authentication and authorization
Prevention and resistance
Detection and response

10. AUTHENTICATION AND AUTHORIZATION
Authentication – a method for confirming users’ identities
The most secure type of authentication involves a combination of the following:
Something the user knows such as a user ID and password
Something the user has such as a smart card or token
Something that is part of the user such as a fingerprint or voice signature

11. Something the User Knows such as a User ID and Password
This is the most common way to identify individual users and typically contains a user ID and a password
This is also the most ineffective form of authentication
Over 50 percent of help-desk calls are password related

12. Something the User Knows such as a User ID and Password

13. Something the User Has such as a Smart Card or Token
Smart cards and tokens are more effective than a user ID and a password
Tokens – small electronic devices that change user passwords automatically
Smart card – a device that is around the same size as a credit card, containing embedded technologies that can store information and small amounts of software to perform some limited processing

14. Unfortunately, this method can be costly and intrusive
Something That Is Part of the User such as a Fingerprint or Voice Signature
This is by far the best and most effective way to manage authentication
Biometrics – the identification of a user based on a physical characteristic, such as a fingerprint, iris, face, voice, or handwriting
Unfortunately, this method can be costly and intrusive

15. PREVENTION AND RESISTANCE
Downtime can cost an organization anywhere from $100 to $1 million per hour
Technologies available to help prevent and build resistance to attacks include:
Content filtering
Encryption
Firewalls

16. Content Filtering
Organizations can use content filtering technologies to filter and prevent s containing sensitive information from transmitting and stop spam and viruses from spreading.
Content filtering – occurs when organizations use software that filters content to prevent the transmission of unauthorized information
Spam – a form of unsolicited

17. ENCRYPTION
If there is an information security breach and the information was encrypted, the person stealing the information would be unable to read it
Encryption – scrambles information into an alternative form that requires a key or password to decrypt the information

18. FIREWALLS
One of the most common defenses for preventing a security breach is a firewall
Firewall – hardware and/or software that guards a private network by analyzing the information leaving and entering the network

19. FIREWALLS
Sample firewall architecture connecting systems located in Chicago, New York, and Boston

20. DETECTION AND RESPONSE
If prevention and resistance strategies fail and there is a security breach, an organization can use detection and response technologies to mitigate the damage
Antivirus software is the most common type of detection and response technology

21. DETECTION AND RESPONSE
Some of the most damaging forms of security threats to e-business sites include:
Malicious code – includes a variety of threats such as viruses, worms, and Trojan horses
Hoaxes – attack computer systems by transmitting a virus hoax, with a real virus attached
Spoofing – the forging of the return address on an so that the message appears to come from someone other than the actual sender
Sniffer – a program or device that can monitor data traveling over a network

22. DETECTION AND RESPONSE
Hackers

23. DETECTION AND RESPONSE
Viruses

24. Closing Case One Thinking Like the Enemy
The Intense School offers several security courses, including the five-day “Professional Hacking Boot Camp” and “Social Engineering in Two Days”
Main philosophy of the Intense School is “To Know Thy Enemy”
The school is taught by several notorious hackers

25. Closing Case One Questions
Describe how an organization can benefit from attending one of the courses offered at the Intense School
Explain the two primary lines of security defense and how organizational employees can use the information taught by the Intense School when drafting an information security plan
Determine the difference between the two primary courses offered at the Intense school, “Professional Hacking Boot Camp” and “Social Engineering in Two Days.” Explain which course is more important for organizational employees to attend

26. Closing Case Two Homeland Security
The issue of homeland security is more paramount today than ever before, for all nations around the world
Government agencies and corporations today are making tremendous strides in working together to deploy systems to help build strong homeland security

27. Closing Case Two Questions
Determine a few of the information security policies that might be implemented along with Gresham’s new Firehouse system
Identify how an information security plan can help the Newport Beach Police Department’s vehicle location system be more successful
How can the Texas Health Network use prevention and resistance technologies to assist in preventing a crisis?

28. Closing Case Two Questions
Explain how Orange County California’s Emergency Operations Center (EOC) might use authentication and authorization technologies to ensure the center’s information security
Research and identify an area of homeland security, not discussed in this case, that uses detection and response technologies to assist in protecting intellectual capital