Management of Information Security Chapter 1: Introduction to the Management of Information Security

1
Management of Information SecurityChapter
1 Introduction to the Management ofInformation
Security

• If this is the information superhighway, its
• going through a lot of bad, bad neighborhoods.
• -- DORIAN BERGER, 1997

2
Introduction

• Information technology is critical to business
  and society
• Computer security is evolving into information
  security
• Information security is the responsibility of
  every member of an organization, but managers
  play a critical role

3
Introduction

• Information security involves three distinct
  communities of interest
• Information security managers and professionals
• Information technology managers and professionals
  
• Non-technical business managers and professionals

4
Communities of Interest

• InfoSec community protect information assets
  from threats
• IT community support business objectives by
  supplying appropriate information technology
• Business community policy and resources

5
What Is Security?

• The quality or state of being secureto be free
  from danger
• Security is achieved using several strategies
  simultaneously

6
Specialized Areas of Security

• Physical security
• Personal security
• Operations security
• Communications security
• Network security
• Information Security (InfoSec)
• Computer Security

7
Information Security

• InfoSec includes information security management,
  computer security, data security, and network
  security
• Policy is central to all information security
  efforts

8
FIGURE 1-1Components of Information Security
9
CIA Triangle

• The C.I.A. triangle is made up of
• Confidentiality
• Integrity
• Availability
• Over time the list of characteristics has
  expanded, but these three remain central

10
Figure 1-2 NSTISSC Security Model
11
Key Concepts of Information Security

• Confidentiality
• Confidentiality of information ensures that only
  those with sufficient privileges may access
  certain information
• To protect confidentiality of information, a
  number of measures may be used including
• Information classification
• Secure document storage
• Application of general security policies
• Education of information custodians and end users

12
Key Concepts of Information Security

• Integrity
• Integrity is the quality or state of being whole,
  complete, and uncorrupted
• The integrity of information is threatened when
  it is exposed to corruption, damage, destruction,
  or other disruption of its authentic state
• Corruption can occur while information is being
  compiled, stored, or transmitted

13
Key Concepts of Information Security

• Availability
• Availability is making information accessible to
  user access without interference or obstruction
  in the required format
• A user in this definition may be either a person
  or another computer system
• Availability means availability to authorized
  users

14
Key Concepts of Information Security

• Privacy
• Information is to be used only for purposes known
  to the data owner
• This does not focus on freedom from observation,
  but rather that information will be used only in
  ways known to the owner

15
Key Concepts of Information Security

• Identification
• Information systems possess the characteristic of
  identification when they are able to recognize
  individual users
• Identification and authentication are essential
  to establishing the level of access or
  authorization that an individual is granted

16
Key Concepts of Information Security

• Authentication
• Authentication occurs when a control provides
  proof that a user possesses the identity that he
  or she claims

17
Key Concepts of Information Security

• Authorization
• After the identity of a user is authenticated, a
  process called authorization provides assurance
  that the user (whether a person or a computer)
  has been specifically and explicitly authorized
  by the proper authority to access, update, or
  delete the contents of an information asset

18
Key Concepts of Information Security

• Accountability
• The characteristic of accountability exists when
  a control provides assurance that every activity
  undertaken can be attributed to a named person or
  automated process

19
What Is Management?

• A process of achieving objectives using a given
  set of resources
• To manage the information security process, first
  understand core principles of management
• A manager is someone who works with and through
  other people by coordinating their work
  activities in order to accomplish organizational
  goals

20
Managerial Roles

• Informational role Collecting, processing, and
  using information to achieve the objective
• Interpersonal role Interacting with superiors,
  subordinates, outside stakeholders, and other
• Decisional role Selecting from alternative
  approaches and resolving conflicts, dilemmas, or
  challenges

21
Differences Between Leadership and Management

• The leader influences employees so that they are
  willing to accomplish objectives
• He or she is expected to lead by example and
  demonstrate personal traits that instill a desire
  in others to follow
• Leadership provides purpose, direction, and
  motivation to those that follow

22

• A Manager administer the resources of the
  organization by
• Creating budgets
• Authorizes expenditures
• Hires employees
• A Manager can also be a leader.

23
Characteristics of a Leader

• Bearing
• Courage
• Decisiveness
• Dependability
• Endurance
• Enthusiasm
• Initiative

• Integrity
• Judgment
• Justice
• Knowledge
• Loyalty
• Tact
• Unselfishness

24
What Makes a Good Leader?

• Action plan for improvement of leadership
  abilities
• Knows and seeks self-improvement
• Be technically and tactically proficient
• Seek responsibility and take responsibility for
  your actions
• Make sound and timely decisions
• Set the example
• Knows subordinates and looks out for their
  well-being

25
What Makes a Good Leader? (Continued)

• Action plan for improvement of leadership
  abilities
• Keeps subordinates informed
• Develops a sense of responsibility in
  subordinates
• Ensures the task is understood, supervised, and
  accomplished
• Builds the team
• Employs a team in accordance with its capabilities

26
Behavioral Types of Leaders

• Three basic behavioral types of leaders
• Autocratic- action-oriented, Do as I say
• Democratic action-oriented and likely to be
  less efficient
• Laissez-faire laid-back.

27
Characteristics of Management

• Two well-known approaches to management
• Traditional management theory using principles of
  planning, organizing, staffing, directing, and
  controlling (POSDC)
• Popular management theory categorizes principles
  of management into planning, organizing, leading,
  and controlling (POLC)

28
Planning

• Planning process that develops, creates, and
  implements strategies for the accomplishment of
  objectives
• Three levels of planning
• Strategic occurs at highest level of
  organization
• Tactical focuses on production planning and
  integrates organizational resources
• Operational focuses on day-to-day operations of
  local resources

29
Planning (Continued)

• In general, planning begins with the strategic
  plan for the whole organization
• To do this successfully, organization must
  thoroughly define its goals and objectives

30
Organization

• Organization is a principle of management
  dedicated to structuring of resources to support
  the accomplishment of objectives
• Organizing tasks requires determining
• What is to be done
• In what order
• By whom
• By which methods
• When

31
Leadership

• Encourages the implementation of the planning and
  organizing functions, including supervising
  employee behavior, performance, attendance, and
  attitude
• Leadership generally addresses the direction and
  motivation of the human resource

32
Control

• Control
• Monitoring progress toward completion
• Making necessary adjustments to achieve the
  desired objectives
• Controlling function determines what must be
  monitored as well using specific control tools to
  gather and evaluate information

33
Solving Problems

• All managers face problems that must be solved.
• Step 1 Recognize and Define the Problem
• Step 2 Gather Facts and Make Assumptions
• Step 3 Develop Possible Solutions
• Step 4 Analyze and Compare the Possible
  Solutions
• Step 5 Select, Implement, and Evaluate a
  Solution

34
Principles Of Information Security Management

• Information security management is part of the
  organizational management team.
• The extended characteristics of information
  security are known as the six Ps
• Planning
• Policy
• Programs
• Protection
• People
• Project Management

35
InfoSec Planning

• Planning as part of InfoSec management is an
  extension of the basic planning model discussed
  earlier in this chapter
• Included in the InfoSec planning model are
  activities necessary to support the design,
  creation, and implementation of information
  security strategies as they exist within the IT
  planning environment

36
InfoSec Planning Types

• Several types of InfoSec plans exist
• Incident response
• Business continuity
• Disaster recovery
• Policy
• Personnel
• Technology rollout
• Risk management and
• Security program including education, training
  and awareness

37
Policy

• Policy set of organizational guidelines that
  dictates certain behavior within the organization
• In InfoSec, there are three general categories of
  policy
• General program policy (Enterprise Security
  Policy)
• An issue-specific security policy (ISSP)
• System-specific policies (SSSPs)

38
Programs

• Programs specific entities managed in the
  information security domain
• A security education training and awareness
  (SETA) program is one such entity
• Other programs that may emerge include a physical
  security program, complete with fire, physical
  access, gates, guards, and so on

39
Protection

• Risk management activities, including risk
  assessment and control, as well as protection
  mechanisms, technologies, and tools
• Each of these mechanisms represents some aspect
  of the management of specific controls in the
  overall information security plan

40
People

• People are the most critical link in the
  information security program
• It is imperative that managers continuously
  recognize the crucial role that people play
• Including information security personnel and the
  security of personnel, as well as aspects of the
  SETA program

41
Project Management

• Project management discipline should be present
  throughout all elements of the information
  security program
• Involves
• Identifying and controlling the resources applied
  to the project
• Measuring progress and adjusting the process as
  progress is made toward the goal