1. On-Line Meeting 2
October 25, 2016

2. ROLL CALL

3. Tonight’s Material

4. Discussion 1
Anyone have any comments they’d like to share about the ISO family of standards? For example: What “purpose” is served by these?

5. Discussion 1
(continued) – Does the “International” nature of the “best practices” in ISO require the “least common denominator” effect?

6. Discussion 2
How do the ISO standards relate to the 8 domains of the Common Body of Knowledge?
… or the CIA triad?

7. Discussion 3 Any comments on the 7 Domains (Reading 1)? User Domain
Workstation Domain
LAN Domain
LAN-to-WAN Domain
WAN Domain
Remote Access Domain
System/Application Domain

8. Discussion 4
Any comments on the presentation of the concepts from Reading 1?
Roles and Tasks
Responsibilities
Accountability
Behind-the-Scenes
Risks, Threats, Vulnerabilities

9. Discussion 5 Comments on the InfoSec Areas (Reading 2)? Acceptable Use
Security Awareness and Training
Asset Classification
Protection and Access Protocols
Asset Management and Operation
Identification, Assessment, and Management of Vulnerabilities
Identification, Assessment, and Management of Threats

10. Discussion 6
Comments on the Information Systems Model?

11. Discussion 7 – Reading 4 Are these 12 principles “widely accepted”?
There is no such thing as Absolute Security.
The three Security Goals are Confidentiality, Integrity, and Availability
Defense in Depth should be the fundamental strategy
When left on their own, most people tend to make the worst security decisions.
Security depends on two types of requirements: Functional and Assurance
Security Through Obscurity is not Security
Security = Risk Management
The three types of Security Controls are Preventive, Detective, and Responsive
Complexity is the Enemy of Security
Fear, Uncertainty and Doubt do not work when selling security
People, Process, and Technology are ALL needed to adequately secure a system or facility.
Open disclosure of Vulnerabilities is good for security

12. Discussion 8 – Reading 4
There is no such thing as Absolute Security.
The three Security Goals are Confidentiality, Integrity, and Availability
Defense in Depth should be the fundamental strategy
When left on their own, most people tend to make the worst security decisions.
Security depends on two types of requirements: Functional and Assurance
Security Through Obscurity is not Security
Security = Risk Management
The three types of Security Controls are Preventive, Detective, and Responsive
Complexity is the Enemy of Security
Fear, Uncertainty and Doubt do not work when selling security
People, Process, and Technology are ALL needed to adequately secure a system or facility.
Open disclosure of Vulnerabilities is good for security

13. Discussion 8 – Reading 4
There is no such thing as Absolute Security.
The three Security Goals are Confidentiality, Integrity, and Availability
Defense in Depth should be the fundamental strategy
When left on their own, most people tend to make the worst security decisions.
Security depends on two types of requirements: Functional and Assurance
Security Through Obscurity is not Security
Security = Risk Management
The three types of Security Controls are Preventive, Detective, and Responsive
Complexity is the Enemy of Security
Fear, Uncertainty and Doubt do not work when selling security
People, Process, and Technology are ALL needed to adequately secure a system or facility.
Open disclosure of Vulnerabilities is good for security

14. Discussion 9 – Reading 4 Security Through Obscurity is not Security
There is no such thing as Absolute Security.
The three Security Goals are Confidentiality, Integrity, and Availability
Defense in Depth should be the fundamental strategy
When left on their own, most people tend to make the worst security decisions.
Security depends on two types of requirements: Functional and Assurance
Security Through Obscurity is not Security
Security = Risk Management
The three types of Security Controls are Preventive, Detective, and Responsive
Complexity is the Enemy of Security
Fear, Uncertainty and Doubt do not work when selling security
People, Process, and Technology are ALL needed to adequately secure a system or facility.
Open disclosure of Vulnerabilities is good for security

15. Discussion 10 – Reading 4 Complexity is the Enemy of Security
There is no such thing as Absolute Security.
The three Security Goals are Confidentiality, Integrity, and Availability
Defense in Depth should be the fundamental strategy
When left on their own, most people tend to make the worst security decisions.
Security depends on two types of requirements: Functional and Assurance
Security Through Obscurity is not Security
Security = Risk Management
The three types of Security Controls are Preventive, Detective, and Responsive
Complexity is the Enemy of Security
Fear, Uncertainty and Doubt do not work when selling security
People, Process, and Technology are ALL needed to adequately secure a system or facility.
Open disclosure of Vulnerabilities is good for security

16. Discussion 11 – Reading 4
There is no such thing as Absolute Security.
The three Security Goals are Confidentiality, Integrity, and Availability
Defense in Depth should be the fundamental strategy
When left on their own, most people tend to make the worst security decisions.
Security depends on two types of requirements: Functional and Assurance
Security Through Obscurity is not Security
Security = Risk Management
The three types of Security Controls are Preventive, Detective, and Responsive
Complexity is the Enemy of Security
Fear, Uncertainty and Doubt do not work when selling security
People, Process, and Technology are ALL needed to adequately secure a system or facility.
Open disclosure of Vulnerabilities is good for security

19. Theme of Tonight’s Class?

20. MENTAL MODEL

21. Notes from an Information Security Lecture
Prepare for Next Week
Reading 6
Notes from an Information Security Lecture

22. Prepare for Next Week Notes from an Information Security Lecture
Reading 6
Notes from an Information Security Lecture
Deep Thought, Pondering, Considering
Supplemental Discussion Questions