Chapter 3

• "Information security refers to the processes and methodologies that are designed to protect sensitive information or data from unauthorized access, use and misuse, disclosure, modification, destruction, or disruption" - introduction
• External Threats

• Human
• Network Security
• Physical Security
• Communication Security
• Software
• Social & economic
• Legal

• Internal threats

• Human
• Fraud/misuse
• Espionage
• Social Engineering
• Infrastructure

• Layers of Protection

• Physical: secured access, asset control, fire protection

• Access Control: clear authentication and authorization

• Application: effective control over web servers, databases and applications

• Network: Firewalls, IDS/IPS

• Host/Platform Security: Host IDS/IPS, anti-virus, hardening of servers

• "defense-in-depth"

• builds over layered security
• Adds additional mechanisms for monitoring, alerting and emergency response

• SABSA(business focused)

• Open, generic, scalable methodology for information security
• Six layers, five vertical layers
• Service Security Management Architecture Layer(Horizontal Layer): Service delivery management
• Contextual: Business users provide business requirements

• Conceptual: Architect provides overall context to the business requirements

• Logical: Designers provide system engineers with model viewing business as a system

• Physical: Builder provides physical security

• Component Security: tradesmen work on specifications given by the builder and work with specialist and system components

• Pillars of security

• People: strongest and weakest pillars of information security
• Organization of Information Security: In an organization, everybody down the line should be involved in information security
• The Need for Independence: Technology is usually headed by a ChiefTechnology Officer or Chief Information Officer who is supported by IT managers and operation staff. However, it's important to watch for conflicts of interest that would lead to security vulnerabilities

• CIA Triad

• Confidentiality: Information that is secret or sensitive should remain that way
• Integrity: Information should not be manipulated or changed
• Availability: Information should be available as it is needed