Environment for Information Security n Distributed computing n Decentralization of IS function n Outsourcing

Environment for Information Security n Close relationships with suppliers and customers n Portable computers n Internet connections

Role of Information Security n Ensure availability of valid information when users need it to run the business n Protect confidentiality of sensitive corporate information n Protect the privacy of users

Role of Information Security n Protect information assets from unauthorized modification n Ensure ability to continue operation in event of a disaster

What Needs to be Protected? n Not all information has same value or importance n Classify the sensitivity of both information and applications

What Needs to be Protected? n Estimate costs to the business if an application were unavailable for one, two days or longer n Estimate damage if competitor gains access or information becomes corrupted

Reappraisal Issues n What are the threats and risks? n Who or what is the enemy? n What are the targets? n Who “owns” the targets?

Reappraisal Issues n How vulnerable are the targets? n How much loss can the company bear? n Which assets are not worth protecting?

Technologies for Security n Expert systems and neural networks – recognizing patterns of behavior – configuring human interface to suit individual users and their permitted accesses

Technologies for Security n Expert systems and neural networks – detection of intrusion through sensors – reconfiguring networks and systems to maintain availability and circumvent failed components

Technologies for Security n Smart cards – contain own software and data – recognize signatures, voices – store personal identification information – may use cryptographic keys n Personal communications numbers

Technologies for Security n Voice recognition n Wireless tokens n Prohibited passwords lists n Third party authentication

Threats to Security n Document imaging systems – reading and storing images of paper documents – character recognition of texts for abstracting and indexing – retrieval of stored documents by index entry

Threats to Security n Document imaging systems (cont’d.) – manipulation of stored images – appending notes to stored images through text, voice – workflow management tools to program the distribution of documents

Threats to Security n Massively parallel mini-supercomputers – used for signal processing, image recognition, large- scale computation, neural networks – can be connected to workstations, file servers, local area networks – good platform for cracking encryption codes

Threats to Security n Neural networks – can “learn” how to penetrate a network or computer system n Wireless local area networks – use radio frequencies or infrared transmission – subject to signal interruption or message capture

Threats to Security n Wide area network radio communications – direct connectivity no longer needed to connect to a network – uses satellite transmission or radio/telephone technology, wireless modems

Threats to Security n Videoconferencing – open telephone lines can be tapped n Embedded systems – computers embedded in mechanical devices – potential to endanger customers – potential to access host computers

Threats to Security n Smart cards – can be lost or damaged n Notebooks and palmtop computers – subject to loss or theft – wireless modems

Defensive Measures n Frequent backups and storage of backups in secure areas n Highly restricted access to workflow management programs

Defensive Measures n Password controls and user profiles n Unannounced audits of high-value documents n Restricted access at the document level

What Security Services Are Required? n Policy and procedure development n Employee training, motivation, and awareness n Secure facilities and architectures

What Security Services Are Required? n Security for applications n Ongoing operational administration and control n Procedural advisory services n Technical advisory services

What Security Services Are Required? n Emergency response support n Compliance monitoring n Public relations

Disaster Recovery Needs Assessment n Who should be involved? – computer and network operations staff – information security specialist – systems analysts for mission-critical operations – end users – external consultants

Disaster Recovery Needs Assessment n Assessing the disaster plan – what kinds of disasters are anticipated? – which applications are mission-critical? – which computer/communications architectures are covered? – when was the plan last updated?

Disaster Recovery Needs Assessment n Assessing the disaster plan – what is the annual cost for maintaining and operating the recovery strategy? – what strategies are used? – how often is the plan tested? – would failure of mission-critical applications incur liability to other firms?

Disaster Recovery Models n “Cold site” backup agreement with another firm specializing in backup services n “Hot site” backup through building or leasing another facility with excess capacity n Distributed processing backup n Replacement