Information Security Fundamentals

Information Security Fundamentals

Trang 1

Chapter 1: Information Security Fundamentals

Security+ Guide to Network Security Fundamentals

Trang 2

2Objectives

• Identify the challenges for information security• Define information security

Trang 3

3Objectives

• List and define information security terminology

Trang 4

4

• Challenge of keeping networks and computers secure has never been greater

• A number of trends illustrate why security is becoming increasingly difficult

• Many trends have resulted in security attacks growing at an alarming rate

Trang 5

5

• Computer Emergency Response Team (CERT) security organization compiles statistics regarding number of reported attacks, including:– Speed of attacks– Sophistication of attacks– Faster detection of weaknesses– Distributed attacks– Difficulties of patching

Trang 6

6Identifying the Challenges for

Trang 7

7Identifying the Challenges for

Trang 8

8

• Information security:

– Tasks of guarding digital information, which is typically processed by a computer (such as a personal

computer), stored on a magnetic or optical storage device (such as a hard drive or DVD), and transmitted over a network spacing

Trang 9

9

• Ensures that protective measures are properly implemented

• Is intended to protect information

• Involves more than protecting the information itself

Trang 10

10Defining Information Security

Trang 12

12Understanding the Importance of

Information Security

• Information security is important to businesses:

– Prevents data theft

– Avoids legal consequences of not securing information– Maintains productivity

Trang 13

13Preventing Data Theft

• Security often associated with theft prevention• Drivers install security systems on their cars to

prevent the cars from being stolen

• Same is true with information security―businesses cite preventing data theft as primary goal of

Trang 14

14Preventing Data Theft (continued)

• Theft of data is single largest cause of financial loss due to a security breach

Trang 15

15Avoiding Legal Consequences

• Businesses that fail to protect data may face serious penalties

• Laws include:

– The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

– The Sarbanes-Oxley Act of 2002 (Sarbox)– The Cramm-Leach-Blilely Act (GLBA)

Trang 16

16Maintaining Productivity

• After an attack on information security, clean-up efforts divert resources, such as time and money away from normal activities

• A Corporate IT Forum survey of major corporations showed:

– Each attack costs a company an average of $213,000 in lost man-hours and related costs

Trang 18

18

• An area of growing concern among defense experts are surprise attacks by terrorist groups using

computer technology and the Internet (cyberterrorism)

• These attacks could cripple a nation’s electronic and commercial infrastructure

• Our challenge in combating cyberterrorism is that many prime targets are not owned and managed by the federal government

Trang 19

19Thwarting Identity Theft

• Identity theft involves using someone’s personal information, such as social security numbers, to

establish bank or credit card accounts that are then left unpaid, leaving the victim with the debts and

ruining their credit rating

• National, state, and local legislation continues to be enacted to deal with this growing problem

Trang 20

20Understanding Information Security

Trang 21

21Exploring the CompTIA Security+

Certification Exam

• Since 1982, the Computing Technology Industry

Association (CompTIA) has been working to advance the growth of the IT industry

• CompTIA is the world’s largest developer of vendor-neutral IT certification exams

Trang 22

22Exploring the CompTIA Security+

Certification Exam (continued)

• Exam was designed with input from security industry leaders, such as VeriSign, Symantec, RSA Security, Microsoft, Sun, IBM, Novell, and Motorola

• The Security+ exam is designed to cover a broad

Trang 23

23Surveying Information Security Careers• Information security is one of the fastest growing career fields

• As information attacks increase, companies are

Trang 24

24Surveying Information Security

Careers (continued)

• Sometimes divided into three general roles:

– Security manager develops corporate security plans and policies, provides education and awareness, and communicates with executive management about

security issues

– Security engineer designs, builds, and tests security solutions to meet policies and address business needs – Security administrator configures and maintains

Trang 25

25Summary

• The challenge of keeping computers secure is becoming increasingly difficult

• Attacks can be launched without human intervention and infect millions of computers in a few hours

• Information security protects the integrity,

confidentiality, and availability of information on the devices that store, manipulate, and transmit the

Trang 26

26Summary (continued)

• Information security has its own set of terminology• A threat is an event or an action that can defeat

security measures and result in a loss

• CompTIA has been working to advance the growth of the IT industry and those individuals working within it• CompTIA is the world’s largest developer of