1. Security Management Chao-Hsien Chu, Ph.D.
College of Information Sciences and Technology
The Pennsylvania State University
University Park, PA 16802
Theory 
Practice
Learning by
Doing
IST 515

2. Environmental Security
Security Management
Framework
Organizational
Security Policy
Organizational
Design
Security Management
Asset Classification
and Control
Access Control
Compliance
Personnel Security
Awareness Education
Physical and
Environmental Security
System Development
and Maintenance
Communications &
Operations Mgmt.
Business Continuity
Management
Operational

3. Objectives This module will familiarize you with the following:
Why securities?
Essential security terminologies.
Core information security principles.
Security management framework.
Information security management governance.
Security policies, procedures, standards, guidelines and baselines
Auditing frameworks for compliance

4. Readings
NIST, “An Introduction to Computer Security,” SP (Oct. 1995). Chapters 2 & 4 (Required).
Tipton, H. and Henry, K. (Eds.), Official (ISC)2 Guide to the CISSP CBK, Auerbach, Domain 1 (Required).
Bowen, P., Hash, J. and Wilson, M., “Information Security Handbook: A Guide for Managers,” NIST, SP (Oct. 2006). Chapter 2.
von Solms, B. and von Solms, R., “The 10 Deadly Sins of Information Security Management,” Computers & Security (2004) 23,
Wikipedia, Information Technology Infrastructure Library.
Wikipedia, COSO Enterprise risk management,
Wikipedia, ISO/IEC

5. Scenario
Stephen used to be the most bullied guy in his circle of friends. Johnson, the neighborhood guy was part of the peer group and foremost in bullying Stephen. Stephen started developing hatred for Johnson.
Johnson owned/hosted a personal website where he showcased his website development skills. He passed the IP address of his website to his peer group so that they could comment on it after viewing the pages.
Stephen comes across an article on hacking on the Internet. Amazed by the potential of tools showcased in that article, he decides to try it hands on. With the downloaded scanning tools, Stephen started scanning the IP of Johnson’s website.
What kind of information will Stephen be exposed to?
Will the scan performed by Stephen affect Johnson’s Website?

6. Why Security? Evolution of technology focused on ease of use
Decreasing skill level needed for exploits
Increased network environment and network based applications

7. Why Security?
Direct impact of security breach on corporate asset base and goodwill.
Increasing complexity of computer infrastructure administration and management.

8. Essential Security Terminologies

9. Essential Security Terminologies

10. Information Security Principles - CIA
Security rests on confidentiality, authenticity, integrity, and availability:
Confidentiality. Only authorized individuals, processes, or systems have access to information on a need-to-know basis.
Integrity. Information should be protected from intentional, unauthorized, or accidental changes.
Availability. Information and resources are accessible when needed. (DoS, DDoS)
Authenticity. The identification and assurance of the origin of information. (Hash function, MD5)

11. Confidentiality, Integrity and Availability
Security
Integrity
Availability

12. Reverse CIA Confidentiality:
Preventing unauthorized subjects from accessing information
Integrity:
Preventing unauthorized subjects from modifying information
Availability:
Preventing information and resources from being inaccessible when needed.

13. Trade-off Functionality Moving the ball towards
security means moving away from the functionality and ease of use
Security
Usability

14. Security/Risk Management Relationships
Determine Needs
& Assess Risks
Central
Management
Implement
Policies &
Control
Monitor &
Evaluate
Promote
Awareness

15. 10 Deadly Sins of Security Management
Not realizing that information security is a corporate governance responsibility (the buck stops right at the top)
Not realizing that information security is a business issue and not a technical issue
Not realizing the fact that information security governance is a multi-dimensional discipline
Not realizing that an information security plan must be based on identified risks
Not realizing the important role of international best practices for information security management

16. 10 Deadly Sins of Security Management
Not realizing that a corporate information security policy is absolutely essential
Not realizing that information security compliance enforcement and monitoring is absolutely essential
Not realizing that a proper information security governance structure is absolutely essential
Not realizing the core importance of information security awareness amongst users
Not empowering information security managers with the infrastructure, tools and supporting mechanisms to properly perform their responsibilities
Lessons
Learned

17. Multi-Dimension of Information Security
The Corporate Governance Dimension
The Organizational Dimension
The Policy Dimension
The Best Practice Dimension
The Ethical Dimension
The Certification Dimension
The Legal dimension
The Insurance Dimension
The Personnel/Human Dimension
The Awareness Dimension
The Technical Dimension
The Measurement/Metrics (Compliance monitoring/Real time IT audit) Dimension
The Audit Dimension

18. Security Management Practice
Security Governance.
Security Policies, Procedures, Standards, Guidelines, and Baselines.
Security Planning.
Security Organization.
Personnel Security.
Security Audit and Control.
Security Awareness, Training and Education.
Risk Assessment and Management.
Professional Ethics.

19. Security Management Governance
Security Governance is the organizational processes and relationships to guarantee that the appropriate information security activities are being performed to ensure that the risks are appropriately reduced, the information security investments are appropriated directed, and the executive management has visibility into the program and is asking the appropriate questions to determine the effectiveness of the program.
Policies, Procedures, Standards, Guidelines, Baselines
Organizational Structures
Roles and Responsibilities

20. Policies, Standards, Procedures, Baselines, & Guidelines
Laws, Regulations, Requirements,
Organizational Goals & Objectives
Procedures, standards, and guidelines are used to describe how these policies will be implemented within an organization.
General Organizational Policies
Management’s
Security Statement
Functional Implementing Policies
Management’s
Security Directives
Standards
Procedures
Baselines
Guidelines
Specific
Hardware &
Software
Step-by-Step
Instructions
Consistent
Level of
Security
Recommendations

21. Audit Frameworks for Compliance
COSO – The Committee of Sponsoring Organization of the Treadway Commission (1985).
ITIL – The IT Infrastructure Library ( ).
ISO 17799/BS 7799 (1995)
ISO/IE (2005)
COBIT – Control Objectives for Information and Related Technology.

22. COSO Integrated Framework
Internal
Environment
Monitoring
Objective
Setting
Enterprise Risk
Management
Information &
Communication
Risk
Identification
Control
Activities
Risk
Assessment
Risk
Response

23. The COSO Cube

24. ITIL Service Management Processes(

25. ITIL Framework (

27. ITIL V3 Processes and Functions
Service
Strategy
Service
Design
Service
Transition
Service
Operation
Continual Service
Improvement
Demand Mgmt.
Service Level
Mgmt.
Knowledge Mgmt.
Service Desk F
Service
Measurement
Financial Mgmt.
Change Mgmt.
Event Mgmt.
Capacity Mgmt.
Service
Reporting
Strategic
Generation
Asset and
Configuration
Mgmt.
Incident Mgmt.
Availability Mgmt.
Service
Improvement
Request
Fulfillment
Service Portfolio
Mgmt.
IT Service
Continuity Mgmt.
Release and
Deployment
Mgmt.
Return on
Investment
Problem Mgmt.
Information
Security Mgmt.
Transition
Planning and
Support
Access Mgmt.
Business
Questions
Supplier Mgmt.
IT Operations
Mgmt. F
Service Catalogue
Mgmt.
Service
Validation and
Testing F
Applications
Mgmt. F
are functions
Evaluation
Technical Mgmt. F (

28. ISO 17799 Standards Information security policy.
Organizing information security.
Asset management.
Human resources security.
Physical and environmental security.
Communications and operations management.
Access control.
Information systems acquisition, development and maintenance.
Information security incident management.
Business continuity management.
Compliance

29. ISO Framework

30. COBIT Business Objectives Governance Objectives Information Monitor &
Effectiveness
Efficiency
Confidentiality
Integrity
Availability
Compliance
Reliability
Monitor &
Evaluate
Plan &
Organize IT
Resources
Deliver &
Support
Acquire &
Implement
Application
Information
Infrastructure
People

31. Summary of Audit Frameworks
COSO – The Committee of Sponsoring Organization of the Treadway Commission (1985).
ITIL – The IT Infrastructure Library ( ).
ISO 17799/BS 7799 (1995)
ISO/IE (2005)
COBIT – Control Objectives for Information and Related Technology.

32. Possible Projects Develop a security audit plan.
Compliance testing according to a standard (e.g., HIPAA, ISO 27000, COBIT, etc.).
Awareness education for HIPAA, ISO 27000, COBIT compliance.
A comparative analysis of different security compliance frameworks.