Security

1
Security

• Chapter 13

2
Areas of Discussion

• A Quick note on How We Got Here
• Managing Security
• Security Solutions and Technologies
• Types of Threats
• Stay Informed
• Additional Resources

3
A Quick Note on How We Got Here

• Java created an operating system so basic it
  would allow, famously, your toaster to talk to
  your computer
• The main challenge originally was to share things
  electronically.
• Today the main challenge is to keep everything
  safe keep data, networks, and companies secure.

4

• Get perspective what affects your company
• Company security themes determine what theme
  your company has
• Privacy vs. security
• Radio frequency identification tags people,
  animals, and objects
• Intention matters
• CIA confidentiality, integrity, and
  availability
• Security vs. convenience

5

• Continued
• Look very closely it may not be what it appears
• Phishing e-mail
• Security stories
• Trojan horses
• Social engineering

6
Managing Security

• Five actions
• Action 1 evaluate your environments needs,
  exposures, and defenses
• Action 2 get upper-level management buy-in
• Action 3 mitigate the risks
• Action 4 work with users to make everyone more
  secure
• Action 5 security is an ongoing process

7
Security Solutions and Technologies

• Tracking and Controlling Access
• Control Access
• Tracking Activity
• System Log Files
• Monitoring Programs
• Network Mapping Tools
• Physical Access
• Accounts and Passwords
• Account usage
• User terminations
• Passwords
• Special privilege IDs

8

• Tracking and Controlling Access
• Access reviews
• Authorization levels
• Authentication
• Two-factor authentication what user knows and
  have
• Single sign-on
• Identity management
• Kerberos
• Other User Authentication methods

9

• Defending the Perimeter
• Firewalls hardware or software based
• Intrusion Detection and Prevention

10

• Malware Prevention
• White list and black list
• Ongoing Maintenance
• Log, account, and access reviews
• Software patches and updates
• Tunneling
• Encryption, Keys, and Certificates
• Staffing
• Responses to Breaches

11
Types of Threats

• Spoofing
• Malware
• Open Relays
• Phishing and Social Engineering
• Security Stories

12
Stay Informed

• Useful security sites
• Computer security standards
• CISSP Certified Information Systems Security
  Professional
• ISO 17799

13
Summary Slide

• A Quick Note on How We Got Here
• Managing Security
• Security Solutions and Technologies
• Stay Informed