Information Security: An Overview

1

• Information Security An Overview
• MISA 11/7/2007
• Chris Clymer

2
Information Security An Overview

• What is Information Security?
• Protecting information and information systems
  from unauthorized access, use, disclosure,
  disruption, modification, or destruction.

3
Information Security An Overview

• Three primary goals of information security
• Confidentiality
• Integrity
• Availability

4
Information Security An Overview

• How does the industry do this?
• Access Control
• Application Security
• Business Continuity/Disaster Recovery
• Cryptography
• Risk Management
• Compliance/Regulations
• Operations Security
• Physical Security
• Security Architecture
• Network Security

5
Information Security An Overview

• These are the ten domains of information security
  as defined by the International Information
  Systems Security Certification Consortium (ISC)2
• These domains form the basis of their Certified
  Information Systems Security Professional
  certification
• The CISSP is widely considered the standard for
  information security professionals

6
Information Security An Overview

• National Citys take on this
• We have over 200 employees in CSS responsible for
  each of those 10 areas
• Physical and Information Security are both part
  of the same department, reporting to the same
  executive
• Security is completely separate from traditional
  Information Technology resources
• Because of this, much like auditors, we form a
  check on the rest of the corporation

7
Information Security An Overview

• Access Control
• This can mean a swipe card to enter a building,
  or a password on a computer
• Authentication, Authorization, and Accountability
• Principle of Least Privilege

8
Information Security An Overview

• Application Security
• Buffer Overflows
• Cross Site Scripting
• SQL Injection
• Man-in-the-Middle
• Directory Traversal
• Session Hijacking
• Denial of Service

9
Information Security An Overview

• Business Continuity/Disaster Recovery
• What do you do when a tornado hits? Blackout?
  Fire?
• Your data is useless if you cannot access it
• availability is big part of BCP/DR

10
Information Security An Overview

• Cryptography
• The practice of hiding information
• Uses mathematic algorithms to obscure information
• All internet commerce is vitally dependent on
  cryptography
• Popular algorithms AES, 3DES, Blowfish

11
Information Security An Overview

• Risk Management
• Identify the risk
• Plan out the process
• Map out stakeholders and scope
• Define a framework
• Analyze the risks
• Mitigation

12
Information Security An Overview

• Compliance/Regulations
• Sarbanes Oxley (SOX)
• Health Insurance Portability and Accountability
  Act (HIPAA)
• Gramm Leach Bliely Act
• PCI Data Security Standard
• ISO17799

13
Information Security An Overview

• Operations Security
• Identification of critical information
• Analysis of threats
• Analysis of vulnerabilities
• Assessment of risk
• Application of appropriate measures
• Goal is to prevent adversary from exploiting
  unclassified, but useful information

14
Information Security An Overview

• Physical Security
• Environmental Design (signs, fences, barriers,
  lights)
• Mechanical (gates, doors, locks)
• Intrusion Detection (sensors, alarms)
• Video Monitoring

15
Information Security An Overview

• Security Architecture
• Access Control Lists
• Role Based Access Control
• Bell-LaPadula Model
• Biba Model
• Clark-Wilson Model
• Graham-Denning Model

16
Information Security An Overview

• Network Security
• Firewalls
• Intrusion Detection Systems
• Intrusion Prevention Systems
• Honeypots

17
Information Security An Overview

• Certifications
• GSEC entry-level cert from SANS
• CISSP mid-level cert from (ISC)2
• GIAC senior-level cert from SANS

18
Information Security An Overview

• Resources Web
• http//www.sans.org
• http//www.cccure.org
• http//www.securityfocus.com
• http//www.schneier.com

19
Information Security An Overview

• Resources Books
• 19 Deadly Sins of Software Security
• The Art of Intrusion Kevin Mitnick
• The Art of Deception Kevin Mitnick
• Secrets and Lies Bruce Schneier
• Practical Cryptography Bruce Schneier
• CISSP Certification Shon Harris

20
Information Security An Overview

• Resources Events
• Information Security Summit http//www.informati
  onsecuritysummit.org
• Northeast Ohio Information Security Forum
  http//www.neoinfosecforum.org
• SANS http//www.sans.org
• Blackhat http//www.blackhat.com
• Shmoocon http//www.shmoocon.org
• Defcon http//www.defcon.org

21
Were Done!

• Questions?