1. Module 02: 1 Introduction to Computer Security and Information Assurance Objectives Recognize that physical security and cyber security are related Recognize that personnel security policies and procedures are related to cyber security Explain how awareness training strengthens cyber security practices

2. Module 02: 2 Introduction to Computer Security and Information Assurance Physical Security Addresses the protection of the organization’s assets: –Personnel –Property –Information

3. Module 02: 3 Introduction to Computer Security and Information Assurance Physical And Cyber Security Disciplines merging Physical access can lead to compromise

4. Module 02: 4 Introduction to Computer Security and Information Assurance Physical Security Threats Most threats in this area are ‘physical’ –Fire –Flood –Natural disasters The Human factor is an exception to this rule

5. Module 02: 5 Introduction to Computer Security and Information Assurance Major Sources Of Physical Loss Temperature extremes Gases Liquids Living organisms Excessive movement Energy anomalies Source: “Fighting Computer Crime” by Donn B. Parker

6. Module 02: 6 Introduction to Computer Security and Information Assurance Physical Security Threat Categories Natural and Environmental Man-made

7. Module 02: 7 Introduction to Computer Security and Information Assurance Natural And Environmental Threats Hurricanes Tornadoes Earthquakes Floods Lightning Mudslides Fire Electrical

8. Module 02: 8 Introduction to Computer Security and Information Assurance Man-Made Threats Hackers Theft Human error

9. Module 02: 9 Introduction to Computer Security and Information Assurance Physical Security Countermeasures Property protection Structural hardening Physical access control Intrusion detection Physical security procedures Contingency plans Physical security awareness training

10. Module 02: 10 Introduction to Computer Security and Information Assurance Property Protection Fences Gates Doors Locks and keys Lighting Fire detection and suppression systems

11. Module 02: 11 Introduction to Computer Security and Information Assurance Structural Hardening Robust construction Minimal penetration Building complexity

12. Module 02: 12 Introduction to Computer Security and Information Assurance Physical Access Control Ensures only authorized individuals are allowed into certain areas –Who –What –When –Where –How

13. Module 02: 13 Introduction to Computer Security and Information Assurance Intrusion Detection Guards Dogs Electronic monitoring systems

14. Module 02: 14 Introduction to Computer Security and Information Assurance Physical Security Procedures Impose consequences for physical security violations Examples: –Log personnel access to restricted areas –Escort visitors, delivery, terminated personnel

15. Module 02: 15 Introduction to Computer Security and Information Assurance Contingency Plans Considerations include –Generators –Fire suppression and detection systems –Water sensors –Alternate facility –Offsite storage facility

16. Module 02: 16 Introduction to Computer Security and Information Assurance Physical Security Awareness Training Train personnel what to do about –Suspicious activities –Unrecognized persons

17. Module 02: 17 Introduction to Computer Security and Information Assurance Personnel Security Practices established to ensure the safety and security of personnel and other organizational assets

18. Module 02: 18 Introduction to Computer Security and Information Assurance Personnel Security It’s all about the people People are the weakest link An avenue to mold and define personnel behavior

19. Module 02: 19 Introduction to Computer Security and Information Assurance Personnel Security Threat Categories Insider threats Social engineering

20. Module 02: 20 Introduction to Computer Security and Information Assurance Insider Threats One of the most common threats to any organization More difficult to recognize Include –Sabotage –Unauthorized disclosure of information

21. Module 02: 21 Introduction to Computer Security and Information Assurance Social Engineering Threats Multiple techniques are used to gain information from authorized employees and using that information in conjunction with an attack –Protect your password (even from the help desk) –Protect personnel rosters

22. Module 02: 22 Introduction to Computer Security and Information Assurance Dumpster Diving Rummaging through a company’s or individual’s garbage for discarded documents, information, and other precious items that could be used in an attack against that person or company

23. Module 02: 23 Introduction to Computer Security and Information Assurance Phishing Usually takes place through fraudulent e- mails requesting users to disclose personal or financial information E-mail appears to come from a legitimate organization

24. Module 02: 24 Introduction to Computer Security and Information Assurance

25. Module 02: 25 Introduction to Computer Security and Information Assurance Security Awareness Recognizing what types of security issues might arise Knowing your responsibilities and what actions to take in case of a breach

26. Module 02: 26 Introduction to Computer Security and Information Assurance Policies And Procedures Acceptable use policy Personnel controls Hiring and termination practices

27. Module 02: 27 Introduction to Computer Security and Information Assurance People And Places: What You Need To Know Physical security Physical security threats and countermeasures Personnel security Personnel security threats and countermeasures