1. Foundations of Organizational Information Assurance Fall 2007 Dr. Barbara Endicott-Popovsky IMT551

3. “OJT” Certification Education The Options …

4. The CIA of IA Confidentiality Integrity Availability ƒ(context, needs, customs, laws)

5. CIA Implementation Controls DefinitionToolsDependencies Confidentiality Concealment of info & resources Hide existence of info & resources Encryption Access control Reliance on system Assumptions & trust about reliance Integrity Trustworthiness of info & resources - Authentication Correctness of data - Data integrity Prevention - Block attempts - Unauth. actions Detection - Block attempts - Unauth. actions Assumptions about source Trust of source Availability Ability to use info & resources System design Statistical models of use Accuracy of statistical models ID anomalies

6. Governance CISO Corp Counsel Business Mgmt IT Legal HR Comm IT Mgmt IT Engineering Business Mgmt IT Legal HR Comm. Enterprise-Wide Implementation of IA Governance CIO CISO Corp Counsel CPA firm Business Goals Secure IT Systems

7. Organization Mission What do you wish to secure? Decide what “secure” means to you, Then identify the threats you care about. Virus Identity Theft Denial of Service Espionage Stolen Customer Data Modified Databases Cyberterrorism Equipment Theft

8. Policies Policies can range from standards to guidelines; general to procedural Policies are requirements for security solutions Controls derive from policies Consequences tied to policies

9. Plethora of Legislation and Regulation Govt. Requirements for better security –HIPAA: Health Insurance Portability & Accountability Act –Sarbanes Oxley –US Patriot Act And more are coming….

10. Threats to Personal Privacy Buying / selling confidential Social Security info. Browsing IRS files. Buying / selling bank account name lists. E-commerce credit card #s, names, passwords