DOCSLIB.ORG

Information Security

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Information Security INFORMATION SECURITY Information Secuirty This text is disseminated via the Open Education Resource (OER) LibreTexts Project (https://LibreTexts.org) and like the hundreds of other texts available within this powerful platform, it freely available for reading, printing and "consuming." Most, but not all, pages in the library have licenses that may allow individuals to make changes, save, and print this book. Carefully consult the applicable license(s) before pursuing such effects. Instructors can adopt existing LibreTexts texts or Remix them to quickly build course-specific resources to meet the needs of their students. Unlike traditional textbooks, LibreTexts’ web based origins allow powerful integration of advanced features and new technologies to support learning. The LibreTexts mission is to unite students, faculty and scholars in a cooperative effort to develop an easy-to-use online platform for the construction, customization, and dissemination of OER content to reduce the burdens of unreasonable textbook costs to our students and society. The LibreTexts project is a multi-institutional collaborative venture to develop the next generation of open-access texts to improve postsecondary education at all levels of higher learning by developing an Open Access Resource environment. The project currently consists of 13 independently operating and interconnected libraries that are constantly being optimized by students, faculty, and outside experts to supplant conventional paper-based books. These free textbook alternatives are organized within a central environment that is both vertically (from advance to basic level) and horizontally (across different fields) integrated. The LibreTexts libraries are Powered by MindTouch® and are supported by the Department of Education Open Textbook Pilot Project, the UC Davis Office of the Provost, the UC Davis Library, the California State University Affordable Learning Solutions Program, and Merlot. This material is based upon work supported by the National Science Foundation under Grant No. 1246120, 1525057, and 1413739. Unless otherwise noted, LibreTexts content is licensed by CC BY-NC-SA 3.0. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation nor the US Department of Education. Have questions or comments? For information about adoptions or adaptions contact [email protected]. More information on our activities can be found via Facebook (https://facebook.com/Libretexts), Twitter (https://twitter.com/libretexts), or our blog (http://Blog.Libretexts.org). This text was compiled on 09/27/2021 TABLE OF CONTENTS 1: INFORMATION SECURITY DEFINED 1.1 INFORMATION SECURITY 1.1.1 INFORMATION SECURITY VS CYBERSECURITY 1.1.2 INFORMATION SECURITY VS NETWORK SECURITY 1.2 THREATS TO INFORMATION SECURITY 1.3 MODELS OF SECURITY - CIA / PARKERIAN HEXAD 1.4 ATTACKS - TYPES OF ATTACKS 1.5: VULNERABILITIES 1.6: RISK 1.4.1: RISK AND VULNERABILITIES 1.7: INCIDENCE RESPONSE 1.8: DEFENSE IN DEPTH 2: AUTHENTICATE AND IDENTIFY 2.1: IDENTIFICATION 2.2: AUTHENTICATION 2.3: AUTHENTICATION METHODS - PASSWORD 2.3.1: AUTHENTICATION METHODS - PASSWORD (CONTINUED) 2.3.2: AUTHENTICATION METHODS - BIOMETRICS 2.3.3: AUTHENTICATION METHODS - SECURITY TOKENS 3: AUTHORIZE AND ACCESS CONTROL 3.1: WHAT ARE ACCESS CONTROLS? 3.2: ACCESS CONTROL - ACL 3.3: ACCESS CONTROL - MODELS 3.4: PHYSICAL CONTROLS 3.4.1: PHYSICAL CONTROLS (CONTINUED) 4: AUDITING AND ACCOUNTABILITY 4.1: ACCOUNTABILITY 5: CRYPTOGRAPHY 6: COMPLIANCE , LAWS AND REGULATIONS 7: OPERATIONS SECURITY 8: HUMAN ELEMENT SECURITY 9: PHYSICAL SECURITY 10: NETWORK SECURITY 11: OPERATING SYSTEMS SECURITY 12: MOBILE, EMBEDDED, AND INTERNET OF THINGS SECURITY 13: APPLICATION SECURITY 1 9/26/2021 14: ASSESSING SECURITY BACK MATTER INDEX GLOSSARY 2 9/26/2021 CHAPTER OVERVIEW 1: INFORMATION SECURITY DEFINED 1.1 INFORMATION SECURITY 1.1.1 INFORMATION SECURITY VS CYBERSECURITY 1.1.2 INFORMATION SECURITY VS NETWORK SECURITY 1.2 THREATS TO INFORMATION SECURITY 1.3 MODELS OF SECURITY - CIA / PARKERIAN HEXAD 1.4 ATTACKS - TYPES OF ATTACKS 1.5: VULNERABILITIES 1.6: RISK 1.4.1: RISK AND VULNERABILITIES 1.7: INCIDENCE RESPONSE 1.8: DEFENSE IN DEPTH 1 9/26/2021 1.1 Information Security Information Security Information security, sometimes shortened to infosec, is the practice of protecting information by mitigating information risks. It is part of information risk management. It typically involves preventing or at least reducing the probability of unauthorized/inappropriate access to data, or the unlawful use, disclosure, disruption, deletion, corruption, modification, inspection, recording or devaluation of information. It also involves actions intended to reduce the adverse impacts of such incidents. Protected information may take any form, e.g. electronic or physical, tangible (e.g. paperwork) or intangible (e.g. knowledge). Information security's primary focus is the balanced protection of the confidentiality, integrity and availability of data (also known as the CIA triad) while maintaining a focus on efficient policy implementation, all without hampering organization productivity. This is largely achieved through a structured risk management process that involves: Identifying information and related assets, plus potential threats, vulnerabilities and impacts; Evaluating the risks; Deciding how to address or treat the risks i.e. to avoid, mitigate, share or accept them; Where risk mitigation is required, selecting or designing appropriate security controls and implementing them; Monitoring the activities, making adjustments as necessary to address any issues, changes and improvement opportunities. To standardize this discipline, academics and professionals collaborate to offer guidance, policies, and industry standards on password, antivirus software, firewall, encryption software, legal liability, security awareness and training, and so forth. This standardization may be further driven by a wide variety of laws and regulations that affect how data is accessed, processed, stored, transferred and destroyed. However, the implementation of any standards and guidance within an entity may have limited effect if a culture of continual improvement isn't adopted. Definition Various definitions of information security are suggested below, summarized from different sources: 1. "Preservation of confidentiality, integrity and availability of information. Note: In addition, other properties, such as authenticity, accountability, non-repudiation and reliability can also be involved." (ISO/IEC 27000:2009)[3] 2. "The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability." (CNSS, 2010)[4] 3. "Ensures that only authorized users (confidentiality) have access to accurate and complete information (integrity) when required (availability)." (ISACA, 2008)[5] 4. "Information Security is the process of protecting the intellectual property of an organisation." (Pipkin, 2000)[6] 5. "...information security is a risk management discipline, whose job is to manage the cost of information risk to the business." (McDermott and Geer, 2001)[7] 6. "A well-informed sense of assurance that information risks and controls are in balance." (Anderson, J., 2003)[8] 7. "Information security is the protection of information and minimizes the risk of exposing information to unauthorized parties." (Venter and Eloff, 2003)[9] 8. "Information Security is a multidisciplinary area of study and professional activity which is concerned with the development and implementation of security mechanisms of all available types (technical, organizational, human-oriented and legal) in order to keep information in all its locations (within and outside the organization's perimeter) and, consequently, information systems, where information is created, processed, stored, transmitted and destroyed, free from threats.Threats to information and information systems may be categorized and a corresponding security goal may be defined for each category of threats. A set of security goals, identified as a result of a threat analysis, should be revised periodically to ensure its adequacy and conformance with the evolving environment. The currently relevant set of security goals may include: confidentiality, integrity, availability, privacy, authenticity & trustworthiness, non-repudiation, accountability and auditability." (Cherdantseva and Hilton, 2013)[2] 9. Information and information resource security using telecommunication system or devices means protecting information, information systems or books from unauthorized access, damage, theft, or destruction (Kurose and Ross, 2010). 1 9/26/2021 https://eng.libretexts.org/@go/page/45653 Overview At the core of information security is information assurance, the act of maintaining the confidentiality, integrity and availability (CIA) of information, ensuring that information is not compromised in any way when critical issues arise. These issues include but are not limited to natural disasters, computer/server malfunction, and physical theft. While paper-based business operations are still prevalent, requiring their own set of information security practices, enterprise digital initiatives are increasingly being emphasized, with information assurance now typically being dealt with by information technology (IT) security specialists.
Load more

Recommended publications
  • Analyzing Cyber Trends in Online Financial Frauds Using Digital Forensics Techniques Simran Koul, Yash Raj, Simriti Koul
    International Journal of Innovative Technology and Exploring Engineering (IJITEE) ISSN: 2278-3075, Volume-9 Issue-9, July 2020 Analyzing Cyber Trends in Online Financial Frauds using digital Forensics Techniques Simran Koul, Yash Raj, Simriti Koul Online frauds refer to the usage of Internet services or other Abstract: Online financial frauds are one of the leading issues open-source software requiring Internet access to frame users in the fields of digital forensics and cyber-security today. Various or to otherwise take advantage of them. Finance-related flaws online firms have been employing several methodologies for the are becoming quite commonplace today. The most common prevention of finance-related malpractices. This domain of criminal activity is becoming increasingly common in the present types of online financial frauds include: cyberspace. In this paper, we will try to implement an online Phishing: Here, the fraudsters acquire users’ sensitive data financial fraud investigation using the digital forensics tool: such as passwords and credit card credentials through email Autopsy. A few existing cyber-security techniques for the messages, fraud websites, and phone calls. investigation of such crimes, namely the Formal Concept Analysis Card Skimming: This crime involves the illegal extraction and Confirmatory Factor Analysis; have been analyzed and of the user’s sensitive financial details on the magnetic stripe reviewed. These techniques are primarily based on mathematical cyber-security concepts. Henceforth, it has been tried to find out from ATMs, debit, and credit cards. This is usually done by whether the investigation of similar crimes can be done the installation of malware on the card reader used by the satisfactorily using the readily-accessible digital forensics tool: victim.
    [Show full text]
  • 193 194 Chapter 17
    National Institute of Standards and Technology Technology Administration U.S. Department of Commerce An Introduction to Computer Security: The NIST Handbook Special Publication 800-12 User Contingency Assurance I & A Issues Planning Personnel Training Access Risk Crypto Controls Audit Planning Management Support Physical Program Threats Policy & Management Security Operations Table of Contents I. INTRODUCTION AND OVERVIEW Chapter 1 INTRODUCTION 1.1 Purpose .................................................... 3 1.2 Intended Audience .......................................... 3 1.3 Organization ............................................... 4 1.4 Important Terminology ..................................... 5 1.5 Legal Foundation for Federal Computer Security Programs . 7 Chapter 2 ELEMENTS OF COMPUTER SECURITY 2.1 Computer Security Supports the Mission of the Organization. 9 2.2 Computer Security is an Integral Element of Sound Management. .............................................. 10 2.3 Computer Security Should Be Cost-Effective. ............... 11 2.4 Computer Security Responsibilities and Accountability Should Be Made Explicit. .......................................... 12 2.5 Systems Owners Have Security Responsibilities Outside Their Own Organizations. ........................................ 12 2.6 Computer Security Requires a Comprehensive and Integrated Approach. ................................................. 13 2.7 Computer Security Should Be Periodically Reassessed. ...... 13 2.8 Computer Security is Constrained by Societal
    [Show full text]
  • Cybersecurity & Computing Innovations
    Cybersecurity & Computing Innovations: Notes In this lesson: - Online Security - Legal & Ethical Concerns - Computing Innovations Online Security: ● Personal identifiable information (PII) is information about an individual that identifies links, relates, or describes them. ● Examples of PII include: ○ Social Security Number ○ Age ○ Race ○ Phone numbers ○ Medical information ○ Financial information ○ Biometric data (fingerprint and retinal scans) ● Search engines can record and maintain a history of search made by users. ○ Search engines can use search history to suggest websites or for targeted marketing. ● Websites can record and maintain a history of individuals who have viewed their pages. ○ Devices, websites, and networks can collect information about a user’s location. ● Technology enables the collection, use, and exploitation of information about by and for individuals, groups and institutions. ● Personal data such as geolocation, cookies, and browsing history, can be aggregated to create knowledge about an individual. ● Personal identifiable information and other information placed online can be used to enhance a user’s experiences. ● Personal identifiable information stored online can be used to simplify making online purchases. ● Commercial and government curation (collection) of information may be exploited if privacy and other protections are ignored. ● Information placed online can be used in ways that were not intended and that may have a harmful effect. ○ For example, an email message may be forwarded, tweets can be retweeted, and social media posts can be viewed by potential employers. ● Personal identifiable information can be used to stalk or steal the identity of a person or to aid in the planning of other criminal acts. ● Once information is placed online, it is difficult to delete.
    [Show full text]
  • An Introduction to Computer Security: the NIST Handbook U.S
    HATl INST. OF STAND & TECH R.I.C. NIST PUBLICATIONS AlllOB SEDS3fl NIST Special Publication 800-12 An Introduction to Computer Security: The NIST Handbook U.S. DEPARTMENT OF COMMERCE Technology Administration National Institute of Standards Barbara Guttman and Edward A. Roback and Technology COMPUTER SECURITY Contingency Assurance User 1) Issues Planniii^ I&A Personnel Trairang f Access Risk Audit Planning ) Crypto \ Controls O Managen»nt U ^ J Support/-"^ Program Kiysfcal ~^Tiireats Policy & v_ Management Security Operations i QC 100 Nisr .U57 NO. 800-12 1995 The National Institute of Standards and Technology was established in 1988 by Congress to "assist industry in the development of technology . needed to improve product quality, to modernize manufacturing processes, to ensure product reliability . and to facilitate rapid commercialization ... of products based on new scientific discoveries." NIST, originally founded as the National Bureau of Standards in 1901, works to strengthen U.S. industry's competitiveness; advance science and engineering; and improve public health, safety, and the environment. One of the agency's basic functions is to develop, maintain, and retain custody of the national standards of measurement, and provide the means and methods for comparing standards used in science, engineering, manufacturing, commerce, industry, and education with the standards adopted or recognized by the Federal Government. As an agency of the U.S. Commerce Department's Technology Administration, NIST conducts basic and applied research in the physical sciences and engineering, and develops measurement techniques, test methods, standards, and related services. The Institute does generic and precompetitive work on new and advanced technologies. NIST's research facilities are located at Gaithersburg, MD 20899, and at Boulder, CO 80303.
    [Show full text]
  • Smart Card Technology : QC100 .U57 NO.500-157 1988 V19 C.1 NIST- St
    ^ NAFL INST OF STANDARDS & TECH R.I.C. oi Computer Science A1 11 02903092 Ni HaykIn, Martha E/Smart card technology : QC100 .U57 NO.500-157 1988 V19 C.1 NIST- St. and Technology (formerly National Bureau of Standards) NBS NIST Special Publication 500-157 PUBLICATIONS Smart Card Technology: New Methods for Computer Access Control Martha E. Haykin Robert B. J. Warnar i Computer Science and Technology iwi NIST Special Publication 500-157 Smart Card Technology: New Methods for Computer Access Control Martha E. Haykin and Robert B. J. Warnar Security Technology Group Institute for Computer Sciences and Technology National Institute of Standards and Technology Gaithersburg, MD 20899 September 1988 / w % NOTE: As of 23 August 1988, the National Bureau of Standards (NBS) became the National Institute of Standards and Technology (NIST) when President Reagan signed Into law the Omnibus Trade and Competitiveness Act. U.S. DEPARTMENT OF COMMERCE C. William Verity, Secretary National Institute of Standards and Technology (formerly National Bureau of Standards) Ernest Ambler, Director Reports on Computer Science and Technology The National Institute of Standards and Technology has a special responsibility within the Federal Government for computer science and technology activities. The programs of the NIST Institute for Computer Sciences and Technology are designed to provide ADP standards, guidelines, and technical advisory services to improve the effectiveness of computer utilization, and to perform appropriate re- search and development efforts as foundation for such activities and programs. This publication series will report these NIST efforts to the Federal computer community as well as to interested specialists in the governmental, academic, and private sectors.
    [Show full text]
  • Authentication Methods
    CERT-EU Security Whitepaper 16-003 Authentication Methods D.Antoniou, K.Socha ver. 1.0 20/12/2016 TLP: WHITE 1 Authentication Lately, protecting data has become increasingly difficult task. Cyber-attacks have become one of the most serious threats to any organization. Companies and organizations are taking measures in order to defend their assets, and the authentication methods are an increasingly important security measure. Authentication is the security term for verifying that the user is indeed who he claims to be. The procedure of confirming a user’s authenticity, is the action of comparing the provided credentials of the user against an existing database of validated identities. However, since depending only on the use of simple credentials – or a single method of authen- tication in general – have lately proven to be highly unreliable, the use of multiple factors for the authentication process is highly recommended. Traditionally, authentication mechanisms have been categorized as either: • Based on a knowledge factor. These methods are vulnerable to obtaining something the user knows (e.g. phishing): password, PIN code, etc. • Based on a possession factor. These methods are vulnerable to obtaining something the user has (e.g. stealing): ID card, token, etc. • Based on an inherence factor. These methods are vulnerable to replicating something the user is (e.g. impersonating): fingerprint, iris scan, etc. 2 Multi-Factor Authentication Multi-factor authentication (MFA) is a method of computer access control in which a user is only granted access after successfully presenting several separate pieces of evidence to an authen- tication mechanism. In practice however, there is still value in multiple methods of the same type, as long as compromising one method does not mean compromising the other as well.
    [Show full text]
  • An Introduction to Computer Security: the NIST Handbook
    Archived NIST Technical Series Publication The attached publication has been archived (withdrawn), and is provided solely for historical purposes. It may have been superseded by another publication (indicated below). Archived Publication Series/Number: NIST Special Publication 800-12 Title: An Introduction to Computer Security: the NIST Handbook Publication Date(s): October 1995 Withdrawal Date: June 21, 2017 Withdrawal Note: SP 800-12 is superseded in its entirety by the publication of SP 800-12 Revision 1. Superseding Publication(s) The attached publication has been superseded by the following publication(s): Series/Number: NIST Special Publication 800-12 Revision 1 Title: An Introduction to Information Security Author(s): Michael Nieles; Kelley Dempsey; Victoria Yan Pillitteri Publication Date(s): June 2017 URL/DOI: https://doi.org/10.6028/NIST.SP.800-12r1 Additional Information (if applicable) Contact: Computer Security Division (Information Technology Laboratory) Latest revision of the SP 800-12 Rev. 1 (as of June 21, 2017) attached publication: Related information: Withdrawal N/A announcement (link): Date updated: :ƵŶĞϮϭ͕ϮϬϭϳ HATl INST. OF STAND & TECH R.I.C. NIST PUBLICATIONS AlllOB SEDS3fl NIST Special Publication 800-12 An Introduction to Computer Security: The NIST Handbook U.S. DEPARTMENT OF COMMERCE Technology Administration National Institute of Standards Barbara Guttman and Edward A. Roback and Technology COMPUTER SECURITY Contingency Assurance User 1) Issues Planniii^ I&A Personnel Trairang f Access Risk Audit Planning ) Crypto \ Controls O Managen»nt U ^ J Support/-"^ Program Kiysfcal ~^Tiireats Policy & v_ Management Security Operations i QC 100 Nisr .U57 NO. 800-12 1995 The National Institute of Standards and Technology was established in 1988 by Congress to "assist industry in the development of technology .
    [Show full text]
  • Computer Security
    Edited by: Dr. Avinash Bhagat COMPUTER SECURITY Edited By Dr.Avinash Bhagat Printed by EXCEL BOOKS PRIVATE LIMITED A-45, Naraina, Phase-I, New Delhi-110028 for Lovely Professional University Phagwara SYLLABUS Computer Security Objectives: To enable the student to understand various threats and security policies for computer systems. Student will learn: cryptography, authorization issues, database security issues, network security issues, design of trusted operating system. Sr. No. Description 1. An Overview of Computer Security: Basic Components, Threats, Goals of Security, Protection State, Assurance and Operational Issues. 2. Information & Network Security Policies: What is a security policy, Types of security polices – Confidentiality policies, Integrity policies, Hybrid policies. 3. Cryptography: What is Cryptography, Substitution Ciphers. Transposition (Permutations). Making “Good” Encryption Algorithms. The Data Encryption Standard (DES). The AES Encryption Algorithm. Public Key Encryption. The Uses of Encryption. 4. Access Control Mechanisms: Access Control Lists, Abbreviations, Creation & Maintenance, Revocation of Rights, Ring based Access Control, Propagated access Control Lists. 5. User Authentication: Basics, Passwords as Authenticators, Attacks on Passwords, Password Selection Criteria, Authentication Process, Biometrics. 6. Designing Trusted Operating Systems: What Is a Trusted System? Security Policies, Models of Security, Trusted Operating System Design, Assurance in Trusted Operating Systems. 7. Database Security:
    [Show full text]
  • Enhancing Multi-Factor Authentication in Modern Computing
    Communications and Network, 2017, 9, 172-178 http://www.scirp.org/journal/cn ISSN Online: 1947-3826 ISSN Print: 1949-2421 Enhancing Multi-Factor Authentication in Modern Computing Ekwonwune Emmanuel Nwabueze1, Iwuoha Obioha2, Oju Onuoha3 1Department of Computer Science, Imo State University, Owerri, Nigeria 2Department of Computer Science, Federal Polytechnic Nekede, Owerri, Nigeria 3Department of Computer Science, Abia State Polytechnic, Aba, Nigeria How to cite this paper: Nwabueze, E.E., Abstract Obioha, I. and Onuoha, O. (2017) Enhanc- ing Multi-Factor Authentication in Modern Most network service providers like MTN Nigeria, currently use two-factor Computing. Communications and Network, authentication for their 4G wireless networks. This exposes the network sub- 9, 172-178. scribers to identify theft and users data to security threats like snooping, https://doi.org/10.4236/cn.2017.93012 sniffing, spoofing and phishing. There is need to curb these problems with the Received: May 5, 2017 use of an enhanced multi-factor authentication approach. The objective of this Accepted: August 6, 2017 work is to create a multi-factor authentication software for a 4G wireless net- Published: August 9, 2017 work. Multi-factor authentication involves user’s knowledge factor, user’s Copyright © 2017 by authors and possession factor and user’s inherence factor; that is who the user is to be pre- Scientific Research Publishing Inc. sented before system access can be granted. The research methodologies used This work is licensed under the Creative for this work include Structured System Analysis and Design Methodology, Commons Attribution-NonCommercial SSADM and Prototyping. The result of this work will be a Multi-factor au- International License (CC BY-NC 4.0).
    [Show full text]
  • “Reducing Systemic Cybersecurity Risk”
    IFP/WKP/FGS(2011)3 MULTI-DISCIPLINARY ISSUES INTERNATIONAL FUTURES PROGRAMME OECD/IFP Project on “Future Global Shocks” “Reducing Systemic Cybersecurity Risk” Peter Sommer, Information Systems and Innovation Group, London School of Economics Ian Brown, Oxford Internet Institute, Oxford University Contact persons: Pierre-Alain Schieb: +33 (0)1 45 24 82 70, [email protected] Anita Gibson: +33 (0)1 45 24 96 27, [email protected] 14th January 2011 This report was written by Peter Sommer and Ian Brown as a contribution to the OECD project ―Future Global Shocks‖. The opinions expressed and arguments employed herein are those of the authors, and do not necessarily reflect the official views of the OECD or of the governments of its member countries. TABLE OF CONTENTS EXECUTIVE SUMMARY ............................................................................................... 6 SYSTEMIC CYBER SECURITY RISK .......................................................................... 9 SYSTEMIC CYBER SECURITY RISK ........................................................................ 10 DESCRIPTION AND HISTORICAL CONTEXT ......................................................... 15 Early days of business and government computing ..................................................... 15 1970s and 1980s: changing patterns of risk ................................................................. 15 Routes to democratisation ............................................................................................ 16 The emergence
    [Show full text]
  • “Reducing Systemic Cybersecurity Risk”
    IFP/WKP/FGS(2011)3 MULTI-DISCIPLINARY ISSUES INTERNATIONAL FUTURES PROGRAMME OECD/IFP Project on “Future Global Shocks” “Reducing Systemic Cybersecurity Risk” Peter Sommer, Information Systems and Innovation Group, London School of Economics Ian Brown, Oxford Internet Institute, Oxford University This report was written by Peter Sommer and Ian Brown as a contribution to the OECD project ―Future Global Shocks‖. The opinions expressed and arguments employed herein are those of the authors, and do not necessarily reflect the official views of the OECD or of the governments of its member countries. Contact persons: Pierre-Alain Schieb: +33 (0)1 45 24 82 70, [email protected] Anita Gibson: +33 (0)1 45 24 96 27, [email protected] 14th January 2011 TABLE OF CONTENTS EXECUTIVE SUMMARY ............................................................................................... 5 SYSTEMIC CYBER SECURITY RISK .......................................................................... 9 DESCRIPTION AND HISTORICAL CONTEXT ......................................................... 15 Early days of business and government computing ..................................................... 15 1970s and 1980s: changing patterns of risk ................................................................. 15 Routes to democratisation ............................................................................................ 16 The emergence of the Internet ...................................................................................... 17
    [Show full text]
  • 7 Code of Practice: a Standard for Information Security Management
    7 Code of Practice: A Standard for Information Security Management Lam-for KWOK1 and Dennis LONGLEY2 1City University ofHong Kong, Tat Chee Avenue, Kin., HONG KONG Tel:+(852)27888625 Fax:+(852)27888614 [email protected] 2Queensland University of Technology GPO Box2434, Brisbane Q4001, AUSTRALIA Tel:+(61)7-38645358 Fax:+(61)7-38641507 [email protected] Abstract The rapid development of networks has caused senior management to reconsider the vulnerabilities of their organisations to information security incidents. Such reconsideration often reveals that the fundamental vulnerabilities lie not with the emerging technology but rather with the lack of an information security infrastructure within the organisation. Appointing a security officer is a common reaction to this situation but the new appointees often find that there is a lack of immediately apparent support form senior management for additional budgets or organisational change and an agreed authoritative source of information security guidelines. The situation has to some extent been addressed by emerging Information Security Management standards such as the BS 7799. This paper discusses the manner in which a security officer may best employ such standards to enhance the level of information security in an organisation. The paper also discusses the fact that the application of the standards reveals the requirements for an organisational security model that may be employed to assist in standards conformance and auditing. Keywords Information security management, information security standards 1 INTRODUCTION Surveys and statistical evidence suggest that many senior management have not traditionally given a high or even moderate level of priority to information management. The rapid © IFIP 1997.
    [Show full text]