Assessment Presentation Philip Robbins - July 14, 2012 University of Phoenix Hawaii Campus Fundamentals of Information Systems Security.

Slides:

Advertisements

Similar presentations

Lynn Ray ISO Towson University Strategic Planning for IT Security Copyright Lynn Ray, This work is the intellectual property rights of the author.

Advertisements

Cyber and Maritime Infrastructure

Chap 1: Overview Concepts of CIA: confidentiality, integrity, and availability Confidentiality: concealment of information –The need arises from sensitive.

Cyber Security: Past and Future John M. Gilligan CERT’s 20 th Anniversary Technical Symposium Pittsburgh, PA March 10, 2009.

Smart Grid - Cyber Security Small Rural Electric George Gamble Black & Veatch

A Covenant University Presentation By Favour Femi-Oyewole, BSc, MSc (Computer Science), MSc (Information Security) Certified COBIT 5 Assessor /Certified.

Lecture 1: Overview modified from slides of Lawrie Brown.

Chapter © 2009 Pearson Education, Inc. Publishing as Prentice Hall.

Cybersecurity Summit 2004 Andrea Norris Deputy Chief Information Officer/ Director of Division of Information Systems.

Security Offering. Cyber Security Solutions 2 Assessment Analysis & Planning Design & Architecture Development & Implementation O&M Critical Infrastructure.

Information Assurance Education Today LTC Clifton H. Poole, CISSP, CISM, IAM Information Resources Management College National Defense University Policy2004.

Comptroller of the Currency Administrator of National Banks E- Security Risk Mitigation: A Supervisor’s Perspective Global Dialogue World Bank Group September.

Security Risk Management Marcus Murray, CISSP, MVP (Security) Senior Security Advisor, Truesec

Resiliency Rules: 7 Steps for Critical Infrastructure Protection.

Information Security Compliance System Owner Training Richard Gadsden Information Security Office Office of the CIO – Information Services Sharon Knowles.

Information Systems Risk Management

Information Security Group DSD & E-Security DSD and E-Security Tim Burmeister Information Security Policy Defence Signals Directorate

Information Security Technological Security Implementation and Privacy Protection.

SEC835 Database and Web application security Information Security Architecture.

CHAPTER 4 Information Security. CHAPTER OUTLINE 4.1 Introduction to Information Security 4.2 Unintentional Threats to Information Security 4.3 Deliberate.

K E M A, I N C. NERC Cyber Security Standards and August 14 th Blackout Implications OSI PI User Group April 20, 2004 Joe Weiss

Lessons Learned in Smart Grid Cyber Security

Computer Science and Engineering 1 Csilla Farkas Associate Professor Center for Information Assurance Engineering Dept. of Computer Science and Engineering.

Dell Connected Security Solutions Simplify & unify.

Computer Science and Engineering 1 Cloud ComputingSecurity.

Security Professional Services. Security Assessments Vulnerability Assessment IT Security Assessment Firewall Migration Custom Professional Security Services.

STRATEGIC INTELLIGENCE MANAGEMENT Chapter by Paul de Souza Chapter 18 - National Cyber Defense Strategy, Pg. 224.

Sample Security Model. Security Model Secure: Identity management & Authentication Filtering and Stateful Inspection Encryption and VPN’s Monitor: Intrusion.

Business Continuity and Disaster Recovery Chapter 8 Part 1 Pages 897 to 914.

Security Standards and Threat Evaluation. Main Topic of Discussion  Methodologies  Standards  Frameworks  Measuring threats –Threat evaluation –Certification.

Chapter 1 Overview The NIST Computer Security Handbook defines the term Computer Security as:

Ali Pabrai, CISSP, CSCS ecfirst, chairman & ceo Preparing for a HIPAA Security Audit.

Understanding Technology Stakeholders: Their Progress and Challenges John M. Gilligan Software Assurance Forum November 4, 2009.

Ali Alhamdan, PhD National Information Center Ministry of Interior

Frankfurt (Germany), 6-9 June 2011 Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 COMMUNICATION & DATA SECURITY.

ITU CoE/ARB 11 th Annual Meeting of the Arab Network for Human Resources 16 – 18 December 2003; Khartoum - Sudan 1 The content is based on New OECD Guidelines.

Cyber Insecurity Under Attack Cyber Security Past, present and future Patricia Titus Chief Information Security Officer Unisys Corporation.

Information Systems, Security, and e-Commerce* ACCT7320, Controllership C. Bailey *Ch in Controllership : The Work of the Managerial Accountant,

A Global Approach to Protecting the Global Critical Infrastructure Dr. Stephen D. Bryen.

Enterprise Cybersecurity Strategy

E NGINEERING STUDIES IN T ELECOMMUNICATIONS S ECURITY School of Communication Engineering.

SecSDLC Chapter 2.

Concept Presentation Philip Robbins - August 1, 2012 University of Phoenix Hawaii Campus Information Systems Security Management.

International Cyber Warfare & Security and B2B Conference Participation of Brazilian Cyber Defense Centre ( )

Introduction and Overview of Information Security and Policy By: Hashem Alaidaros 4/10/2015 Lecture 1 IS 332.

Latest Strategies for IT Security Margaret Myers Principal Director, Deputy CIO United States Department of Defense North American Day 2006.

Protecting Against Cyber Challenges Pacific Operational Science & Technology Conference 15 March 2011 Rob Wolborsky Chief Technology Officer Space and.

SECURITY REQUIREMENTS AND MANAGEMENT: Presentation By: Guillermo Dijk.

IS3220 Information Technology Infrastructure Security

Sicherheitsaspekte beim Betrieb von IT-Systemen Christian Leichtfried, BDE Smart Energy IBM Austria December 2011.

EUROPEAN SECURITY POLICY A SNAPSHOT ON SURVEILLANCE AND PRIVACY DESSI WORKSHOP, CPH 24 JUNE 2014 Birgitte Kofod Olsen, Chair Danish Council for Digital.

1.  1. Introduction  2. Policy  3. Why Policy should be developed.  4. www policies 2.

Information Management System Ali Saeed Khan 29 th April, 2016.

Digital Security Focus Area & Critical Infrastructure Protection in H2020 SC7 WP Aristotelis Tzafalias Trust and Security Unit DG Communications.

© ITT Educational Services, Inc. All rights reserved. IS4680 Security Auditing for Compliance Unit 1 Information Security Compliance.

Donald JG Chiarella, PhD, CISM, CDMP, PEM, CHS-CIA, MBA.

CS457 Introduction to Information Security Systems

Information Technology Sector

Cyber Security: State of the Nation

ISA 400 Management Information Security

BUILDING A PRIVACY AND SECURITY PROGRAM FOR YOUR NON-PROFIT

8 Building Blocks of National Cyber Strategies

By: Tekeste Berhan Habtu Chief Executive Officer Venue: African Union

Understanding Security Layers

Computer Science and Engineering

Cybersecurity Threat Assessment

Cyber Security in a Risk Management Framework

Unit # 1: Overview of the Course Dr. Bhavani Thuraisingham

Presentation transcript:

Assessment Presentation Philip Robbins - July 14, 2012 University of Phoenix Hawaii Campus Fundamentals of Information Systems Security

Scope & Applicability UOPX Courses -CIS 207 Information Systems Fundamentals -CMGT 244 Intro to IT Security -CMGT 245 IS Security Concepts -CMGT 400 Intro to Information Assurance & Security -CMGT 440 Intro to Information Systems Security -CMGT 441 Intro to Information Systems Security Management -CMGT 430 Enterprise Security -CMGT 442 Information Systems Risk Management

Objectives Review of Concepts. What is (are): -Information Systems? -Information Security? -Information Systems Security? -Information Assurance? -Cyber Security? -Defense in Depth? Significance / Importance of Concepts Advanced Topics in Security Risk Analysis Present & Future Challenges Q&A

Who am I? Information Systems Authorizing Official Representative -United States Pacific Command (USPACOM) -Risk Management Field -Assessments to USPACOM Authorizing Official / CIO Former Electronics Engineer Bachelor of Science in Electrical Engineering Master of Science in Information Systems Ph.D. Student in Communication & Information Sciences Certified Information Systems Security Professional (CISSP) and Project Management Professional (PMP)

Review of Concepts What are Information Systems? -Systems that store, transmit, and process information. + What is Information Security? -The protection of information What is Information Systems Security? -The protection of systems that store, transmit, and process information.

Review of Concepts What is Information Assurance? -Emphasis on Information Sharing -Establishing and controlling trust -Authorization and Authentication (A&A) What is Cyber Security? -Protection of information and systems within networks that are connected to the Internet.

Review of Concepts Progression of Terminology Computer Security (COMPUSEC) Information Security (INFOSEC) Information Assurance (IA) Cyber Security Legacy Term (no longer used). Legacy Term (still used). Term widely accepted today with focus on Information Sharing. Broad Term quickly being adopted.

Review of Concepts What is the Defense in Depth Strategy? -Using layers of defense as protection. People, Technology, and Operations. Onion Model

Review of Concepts

ISS Management What is a Backup Plan (BP) vs Disaster Recovery Plan (DRP) vs Emergency Response Plan (ERP) vs Business Recovery Plan (BRP) vs Business Impact Analysis (BIA) vs Incident Response Plan (IRP) vs Continuity of Operations Plan (COOP) vs Contingency Plan? Policy & Planning Test, Audit, Update Configuration Control Protection, Detection, Reaction (Assessment, CND, Incident Response)

Why is this important? Information is valuable. therefore, Information Systems are valuable. etc… Compromise of Information Security Services (C-I-A) have real consequences (loss) -Confidentiality: death, proprietary info, privacy, theft -Integrity: theft, disruption -Availability: productivity lost, C2, defense, emergency services

Why is this important? Fixed Resources Sustainable strategies reduce costs

Advanced Topics: Measuring Risk What is Risk? thus Qualitative v.s. Quantitative Methods Risk Assessments v.s. Risk Analysis Security Risk Analysis (SRA) Units for measurement?

Advanced Topics: Measuring Risk Risk is conditional, NOT independent.

Advanced Topics: Measuring Risk Quantitative, time-dependent (continuous), Risk Distribution Function: Source: Robbins, P. (Dec, 2011). Security Risk Analysis and Critical Information Systems (Master's Thesis). Hawaii Pacific University, Honolulu, HI.Security Risk Analysis and Critical Information Systems

Advanced Topics: Measuring Risk Expected Value of Risk = Product of Risks Risk is never zero Risk Dimension (units): confidence in ISS, C-I-A

Advanced Topics: Measuring Risk Expected Value and Risk Loss Confidence vs Cumulative Risk Product

Advanced Topics: Measuring Risk Quantitative Risk Determination Expression Risk Rate & Risk Variability Adjudication of Risk

Advanced Topics: Measuring Risk Determining Risk Tolerance / Threshold Levels

Advanced Topics: Measuring Risk Risk Areas as a function of Probability and Impact

Present Challenges Rapid growth of Advanced Persistent Threats (APTs) Half million cases of cyber related incidents in Is this a problem? What about vulnerabilities associated with interconnections? Source: US-CERT

Future Challenges Cyberspace: Are we at war? Cyber Crime vs Cyber Warfare vs Cyber Conflict

Closing Thoughts Information Systems Security (Cyber Security) is an explosive field. - Spanning Commercial, Private and Government Sectors - Demand >> Capacity: Strategies, solutions, workforce - $ - Evolving field (not fully matured) Security will change our communications landscape - Efficiencies (centralization of services, technology) - Intelligent design of network interconnections and interdependencies - Regulations

Thank you! Got Questions?