Information Security: DBPO

Information Security ConcernsSoftware Vulnerabilties

Network Security and AuthenticationOpen Discussion

Information Security

Sukant Kole

Advanced Centre for Informatics & Innovative LearningIndira Gandhi National Open University, New Delhi

August 24, 2010

Sukant Kole BPOI-007 Course 7 - IT Skills: DBPO-Finance & Accounting

IntroductionAttributes of Information SecurityType of threatsTypes of security measuresEncryptionSecurity Policies

What is Information Security ?

Definition

Information Security means protection of information andinformation system from unauthorized access, modification andmisuse of information or destruction.

Impact of Weather Forecasting & Flight Scheduling System

What is Information Security ?

Definition

Information Security means protection of information andinformation system from unauthorized access, modification andmisuse of information or destruction.

Impact of Weather Forecasting & Flight Scheduling System

Integrity

Confidentiality

Availability

Security

Privacy

Integrity

Confidentiality

Availability

Security

Privacy

Integrity

Confidentiality

Availability

Security

Privacy

Integrity

Confidentiality

Availability

Security

Privacy

Integrity

Confidentiality

Availability

Security

Privacy

Physical

(Malicious insiders, Careless Employees)

Network

Application (Exploited Vulnerabilities, Zero day attacks)

Access Devices Mobile devices, USB Devices

Social Networking

Cloud computing security

Cyber Espionage

Physical

(Malicious insiders, Careless Employees)

Network

Social Networking

Cyber Espionage

Physical (Malicious insiders, Careless Employees)

Network

Application

(Exploited Vulnerabilities, Zero day attacks)

Social Networking

Cyber Espionage

Network

Application

Social Networking

Cyber Espionage

Network

Application

Social Networking

Cyber Espionage

Network

Access Devices

Mobile devices, USB Devices

Social Networking

Cyber Espionage

Network

Access Devices

Mobile devices, USB Devices

Social Networking

Cyber Espionage

Network

Social Networking

Cyber Espionage

Network

Social Networking

Cyber Espionage

Network

Social Networking

Cyber Espionage

Network

Social Networking

Cyber Espionage

Network

Social Networking

Cyber Espionage

Access restriction to datacentre, Security surveillance,Disaster Recovery

VLAN, Authentication Authorization & Auditing service,WPA-PSK

Security patches, Stable version, 3 tier architecture

What is encryption ?

Definition

“....In cryptography, encryption is the process of transforminginformation (referred to as plaintext) using an algorithm (calledcipher) to make it unreadable to anyone except those possessingspecial knowledge, usually referred to as a key. The result of theprocess is encrypted information (in cryptography, referred to asciphertext....” (Source: Wikipedia)

Symmetric Encryption

(Ref: http://www.devx.com/dbzone/Article/29232/1954)

Asymmetric Encryption

(Ref: www.uic.edu/depts/accc/newsletter/adn26/figure2.html)

User Policies

(Password, Resource Access)

IT Policies (Backup, firewall, IDS & IPS)

General (Service License Agreement, Business Continuity)

User Policies

(Password, Resource Access)

User Policies (Password, Resource Access)

IT Policies

(Backup, firewall, IDS & IPS)

IT Policies

(Backup, firewall, IDS & IPS)

General

(Service License Agreement, Business Continuity)

General

(Service License Agreement, Business Continuity)

Introduction

Infection process

Viruses

Worm (Morris Worm, November 2, 1988)

Trojan Horses

Social Engineering attacks

Introduction

Infection process

Viruses

Trojan Horses

Introduction

Infection process

Viruses

Trojan Horses

Introduction

Infection process

Viruses

Trojan Horses

Introduction

Infection process

Viruses

Trojan Horses

Introduction

Infection process

Viruses

Trojan Horses

Introduction

Infection process

Viruses

(Morris Worm, November 2, 1988)

Trojan Horses

Introduction

Infection process

Viruses

(Morris Worm, November 2, 1988)

Trojan Horses

Introduction

Infection process

Viruses

Trojan Horses

Introduction

Infection process

Viruses

Trojan Horses

Introduction

Infection process

Viruses

Trojan Horses

What is network securityThreats to network securityTools of network securitySecure network devices

Definition

“....In the field of networking, the specialist area of networksecurity consists of the provisions and policies adopted by thenetwork administrator to prevent and monitor unauthorized access,misuse, modification, or denial of the computer network andnetwork-accessible resources....” (Source: Wikipedia)

Denial of Service (ARP Posioning, DNS Cache Poisoning,Packet flooding)

Unauthorized access to resources (unsecured LAN /WLANnetwork points)

MAC Spoofing, Man-in-the-middle attack

Firewall [Software, Hardware]

Virtual LANs, Virtual Private Networks

Secured and encrypted access to resources

De-Militarized Zones

Intrusion Detection & Prevention System

Honeypots

Directory Services (LDAP, MS-ADS)

Vulnerability Assessment tools (Nessus, Wireshark)

Penetration Testing assessment

Honeypots

Virtual LANs

Authentication, Authorization, Auditing Service (Desktop,Web)

Virtual LANs

Information Security: DBPO

Education

Information Security Supporting an Information …Information Security Report 2010 Year ended March 31, 2010 NEC Corporation Information Security Supporting an Information Society

Information technology – Security techniques – Information ... · INTERNATIONAL STANDARD ISO/IEC 27005 Information technology – Security techniques – Information security

Security Cooperation Information Portal (SCIP) Case ... SCIP EXERCISE BOOK... · Security Cooperation Information Portal (SCIP) Case Information ... The Security Cooperation Information

INFORMATION SECURITY STANDARD #01 Security Classification ... · INFORMATION SECURITY STANDARD #01. Security Classification of UBC Electronic Information Introduction 1. UBC Electronic

Information Security 1 Information Security: Demo of Some Security Tools Jeffy Mwakalinga

Information Security Policy - British Columbia · Information Security Program, headed by the Chief Information Security Officer, as the Executive Director of the Information Security

Information Security What is Information Security?

Information technology- security techniques information ... · ISO/IEC 27001 was prepared by Joint ... Information technology — Security techniques — Information security management

Information technology — Security techniques — Information security … · Information technology — Security techniques — Information security for supplier relationships —

Information Security Management System.€¦ · Information Security Management System. Information Security at Bühler. V1.0, March 2020. 2 Information Cyber Security at Bühler

Certified Information Systems Security … Information Systems Security Professional (CISSP) Course 1 - Information Security and Risk Management

Information Security Awareness Training. Agenda What is Information Security? Information Ecosystem C-I-A Godrej & Boyce Information Security Organization

Information Systems Security Information Security for Web- based Applications

Information Technology Information and Systems Security ...€¦ · Information and Systems Security/Compliance Information Security Vulnerability ... Assessment or at the beginning

Information security in general practice...Information security in general practice 3Practice information security policies Polices should be created to support information security

GOVERNMENT INFORMATION SECURITY REFORM ACT · PDF fileGOVERNMENT INFORMATION SECURITY REFORM ACT ... Information Technology Audits Staff ... “Government Information Security Reform

Information Security Management. Workshop Agenda Understanding your Information Security EnvironmentUnderstanding your Information Security Environment

SAM INFORMATION SECURITY (Office of … – INFORMATION SECURITY (Office of Information Security) Rev. 426 ... INFORMATION ASSET MANAGEMENT 5305.5 ... SAM – INFORMATION SECURITY

Information Security Trends The Information Security Process Information Security Trends Emiliano Kargieman ek@corest.com

Information Security & Identity Theft - Banking with … · Information Security & Identity Theft What is Information Security? (continued) ® Information Security Core Principles