Scribd
Upload
100 views32 pages

2.5.1 Information System Security

The document discusses information system security. It notes that most information systems are now connected to the internet, exposing them to threats from outside. This can result in catastrophic consequences for an organization if the system is not secure. The document outlines various elements of information security like confidentiality, integrity, availability and authentication. It also discusses why security is important, common cyber threats, and techniques to achieve effective information security through administrative, technical and physical controls.

Uploaded by

Rishika Singh
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
100 views32 pages

2.5.1 Information System Security

The document discusses information system security. It notes that most information systems are now connected to the internet, exposing them to threats from outside. This can result in catastrophic consequences for an organization if the system is not secure. The document outlines various elements of information security like confidentiality, integrity, availability and authentication. It also discusses why security is important, common cyber threats, and techniques to achieve effective information security through administrative, technical and physical controls.

Uploaded by

Rishika Singh
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 32

Information System

Security
Information System Security
 Today most of the IS are connected to internet.

 Thus they are exposed to the outside world directly.

 Threats from the outside world must be addressed.

 Damage from a non-secure IS can result in


catastrophic consequences for the organization.

 Thus organizations must investigate and evaluate the


factors that could be a threat.
What Is Information Security???

 Protection of information systems against unauthorized access


to or modification of information, whether in storage, processing
or transit, and against the denial of service to authorized users
or

 the provision of the service to unauthorized users, including


those measures necessary to detect, document, and counter
such threats.

 Information security means making sure to provide required


information for the correct people at the correct time.
Why Information Security???
 Use of IT across businesses
 Fast growth of Internet
 Commercialization of
Internet
 Web site defacement
 Theft of confidential data
 Financial Frauds
 Legal requirements
Why Information Security???
 Increased rate of cyber crime issues.

 Cyber crime is defined as criminal activity involving


the IT infrastructure, including illegal access, illegal
interception, data interference, misuse of devices, ID
theft and electronic fraud.
Cyber Crime Techniques
 Data Scavenging
 Shoulder Surfing
 Piggy Backing
 Man In the middle
 Social Engineering
Shoulder Surfing
 Buffer overruns
 SQL injections
 Ransomware

Piggy Backing
Why Information Security???
 Cookies
 Cross Site Scripting (XSS)
 SPAM
 Denial Of Service (DOS)/ DDOS
 Virus / Worms/ Trojans
 Spyware / Adware
 Phishing
 Spoofing … … … … … … … … . . Etc.
Elements of Information Security
Three basic elements of Information Security.

 Confidentiality

 Integrity

 Availability
Confidentiality

Confidentiality: Confidentiality specifies that only the sender and


receiver should be able to access the content of message.

Fig. Attack on Confidentiality


Integrity
• Integrity means that data is protected from unauthorized changes
to ensure that it is reliable and correct. assurance that the
message is unaltered
• Integrity involves maintaining the consistency, accuracy, and
trustworthiness of data over its entire life cycle.
Availability
• Available to authorized entities for 24/7.
• Availability guarantees that systems, applications
and data are available to users when they need
them.
The most common attack that impacts  availability 
• Denial-of-service (DoS)
• Distributed Denial Of Attack (DDoS)
Authentication
• Authentication mechanisms help establish proof of identities.
• The authentication process ensures that the origin of an
electronic message or document is correctly identified
Techniques or mechanisms used for Integrity are :
1. Login passwords
2. Authentication token
3. One time Password(OTP)
4. Digital Certificate based authentication
5. Biometric Authentication
6. Kerberos
7. Single sign on (SSO)
8. Message Authentication code (MAC)
9. HMAC( hash based MAC)
10. Digital signature
Other Elements of InfoSec

 Identification – recognition of an entity by a system.

 Authentication-Process of verifying identity.

 Accountability –Tracing activities of individual on a system.

 Authorization- Granting access or other permissions.

 Privacy- Right of individual to control the sharing of information


about him.
How to achieve Information Security???

 Information Security does not mean only installing antivirus


and firewalls.

 Information security tends to protect hardware, software,


data, procedures, records, supplies and human resources.

 Information assets are those resources that store,


transport, create, use or are information.

 Information Security is the responsibility of everyone


who can affect the security of a system.
How to achieve Information Security???

 Administrative Controls- Policies, standards,


procedures, guidelines, employee screening,
change control, Security awareness trainings.

 Technical Controls- Access controls,


encryption, Firewalls, IDS, IPS,HTTPS

 Physical Controls- controlled physical access to


resources, monitoring, no USB or CDROM etc.
Some Good Habits

 Always use official software.


 Keep all software uptodate with patches.
 If using free software always download from original developers
site.
 Do not disclose all your information on internet sites like
orkut/Facebook.
 Use Internet with control.
 Use email properly.
 Take care while discarding your waste material.
 Use small gadgets carefully as information storage.
Information System Security

 Vulnerability
• It is the weakness within a system. It is the degree of
exposure in view of threat.

 Threat
• A threat is a possible event that can damage or harm an
Information System.

Countermeasures
• It is a set of actions implemented to prevent threats.
Information System Security

 Network Level Threats


 Attacker requires network access to organization systems
or networks.
 Hacking Computers, Implementing Spywares

 Information Level Threats


 Attack on the information.
 Sending fake queries to sales department
 Submitting false information.
 Creating revenge web sites.
Information System Security
 Major Security Threats to an
IS

 Computer Crimes / Abuse

 Human Error

 Failure of Hardware or Software

 Natural Disasters

 Political Disasters
Information System Security
 Computer Crime / Abuse
 Computer Viruses
 A code that performs malicious act.
 Can insert itself into other programs in a system.
 Worm is a virus that can replicate itself to other systems
using network.
 Biggest threat to personal computing.
 Trojan Horse
 A program that performs malicious or unauthorized acts.
 Distributed as a good program.
 May be hidden within a good program.
Information System Security
 Denial of Service (DoS)
 Making system unavailable to legitimate users.
 Impersonation
 Assuming someone else’s identity and enjoying his
privileges.
 Salami Technique
 Diverting small amount of money from a large number of
accounts maintained by the system.
 Small amounts go unnoticed.
 Spoofing
 Configuring a computer to assume some other computers
identity.
Information System Security
 Scavenging
 Unauthorized access to information by searching through
the remains after a job is finished.
 Dumpster diving
 Data Leakage
 Various techniques are used to obtain stored data
 SQL injection
 Error Outputs
 Wiretapping
 Tapping computer transmission lines to obtain data.
 Theft of Mobile Devices
Information System Security
 Myths, rumors and hoaxes
 Created by sending false emails to as many people as
possible.
 These may have significant impact on companies, their
reputation and business.

 Web Site Attacks


 Web site defacement
 Adding wrong information

 Increase in cyber crime rates


 Organized cyber criminals
Information System Security
 Employee Issues
 Disgruntle Employees
 Availability of hacking tools

 Social Engineering Attacks


 Sharing Passwords
 Sharing Official Systems
 Not following clean desk policy

 Rise in Mobile workers


 Use mobile devices
 Wireless access
 Lots of organization data
exposed
Classification of Threats
 Basic of the effective Security Management.

 Organization require to know the damage caused when


security incident or an attack happens.

 This helps management to decide the budget for security


related expenditures.

 Organizations can not secure everything.

 Organizations can not spend too much on security.


Classification of Threats
 Four things to be considered while evaluating
threat

 Asset
 Something of value to the organization
 Actor / Attacker
 Who or what may violate the security requirement
 Motive
 Deliberate or accidental
 Access
 How the attacker will access the asset.
Classification of Threats
 Types of
assets

 Hardware

 Software

 Information

 Systems

 People
Classification of Threats
 Classify Assets

 Tag Assets based on their value to the


organization.

 Find various threats to important assets.

 Tag threats for an asset.

 Find the threats which have maximum risk.

 Calculate the loss due to these threats.


Classification of Threats
 Cost of a threat can be calculated considering
following factors
 Productivity
 No. of employees affected
 No. of hours wasted
 Cost per hour / per employee
 Revenue
 Direct financial loss
 Future business loss
 Financial Performance
 Credit rating and stock price
 Other Expenses
 Hidden Costs
Classification of Threats
 Cost of a threat can be calculated considering
following factors
 Other Expenses
 Overtime Costs
 Travel Expenses
 Third Party costs
 Equipment Rental Costs

 Hidden Costs
 Difficult to calculate
 Cost of damaged reputation
 Loss of faith by customers, bankers or vendors
Information System Security
 The aim of the information system security is to protect
organization assets.

 If not fully protected at least limit damage to them.

 Limit access to information to authorized users only.

 Information systems controls play a crucial role to


ensure secure operations of IS.

 They safeguard the assets and the data within them.


Information System Security

 The organization needs to develop a set of security policies,


procedures and technological measures.
 Information System Controls-
 Preventive Controls
 Prevent an error or attack

 Detective Controls
 Detect a security breach or incident

 Corrective Controls
 These control detect any error or incident and correct it.

You might also like