- Information
- AI Chat
Information Security
What is Information Security (InfoSec)? Information security (sometime...
Subject
Information Technology
362 Documents
Students shared 362 documents in this course
Degree
FET
School
SEAT Academy
Academic year: 2023/2024
Uploaded by:
Anonymous Student
This document has been uploaded by a student, just like you, who decided to remain anonymous.
Southern Alberta Institute of TechnologyRecommended for you
Preview text
Information Security: The Ultimate
Guide
What is Information Security (InfoSec)?
Information security (sometimes referred to as InfoSec) covers the tools and
processes that organizations use to protect information. This includes policy
settings that prevent unauthorized people from accessing business or personal
information. InfoSec is a growing and evolving field that covers a wide range
of fields, from network and infrastructure security to testing and auditing.
Information security protects sensitive information from unauthorized
activities, including inspection, modification, recording, and any disruption or
destruction. The goal is to ensure the safety and privacy of critical data such
as customer account details, financial data or intellectual property.
The consequences of security incidents include theft of private information,
data tampering, and data deletion. Attacks can disrupt work processes and
damage a company’s reputation, and also have a tangible cost.
Organizations must allocate funds for security and ensure that they are ready
to detect, respond to, and proactively prevent, attacks such
as phishing, malware, viruses, malicious insiders, and ransomware.
Whitepaper: Meeting Data Security Challenges in the Age of Digital
Transformation.
What are the 3 Principles of Information Security?
The basic tenets of information security are confidentiality, integrity and
availability. Every element of the information security program must be
designed to implement one or more of these principles. Together they are
called the CIA Triad.
Confidentiality
Confidentiality measures are designed to prevent unauthorized disclosure of
information. The purpose of the confidentiality principle is to keep personal
information private and to ensure that it is visible and accessible only to those
individuals who own it or need it to perform their organizational functions.
Integrity
Consistency includes protection against unauthorized changes (additions,
deletions, alterations, etc.) to data. The principle of integrity ensures that data
is accurate and reliable and is not modified incorrectly, whether accidentally or
maliciously.
Availability
Availability is the protection of a system’s ability to make software systems
and data fully available when a user needs it (or at a specified time). The
purpose of availability is to make the technology infrastructure, the
applications and the data available when they are needed for an organizational
process or for an organization’s customers.
Blog: 7 Ways Good Data Security Practices Drive Data Governance.
The CIA Triad defines three key principles of data security
Unsecure or Poorly Secured Systems
The speed and technological development often leads to compromises in
security measures. In other cases, systems are developed without security in
mind, and remain in operation at an organization as legacy systems.
Organizations must identify these poorly secured systems, and mitigate
the threat by securing or patching them, decommissioning them, or isolating
them.
Social Media Attacks
Many people have social media accounts, where they often unintentionally
share a lot of information about themselves. Attackers can launch attacks
directly via social media, for example by spreading malware via social media
messages, or indirectly, by using information obtained from these sites to
analyze user and organizational vulnerabilities, and use them to design an
attack.
Social Engineering
Social engineering involves attackers sending emails and messages that trick
users into performing actions that may compromise their security or divulge
private information. Attackers manipulate users using psychological triggers
like curiosity, urgency or fear.
Because the source of a social engineering message appears to be trusted,
people are more likely to comply, for example by clicking a link that installs
malware on their device, or by providing personal information, credentials, or
financial details.
Organizations can mitigate social engineering by making users aware of its
dangers and training them to identify and avoid suspected social engineering
messages. In addition, technological systems can be used to block social
engineering at its source, or prevent users from performing dangerous actions
such as clicking on unknown links or downloading unknown attachments.
Malware on Endpoints
Organizational users work with a large variety of endpoint devices, including
desktop computers, laptops, tablets, and mobile phones, many of which are
privately owned and not under the organization’s control, and all of which
connect regularly to the Internet.
A primary threat on all these endpoints is malware, which can be transmitted
by a variety of means, can result in compromise of the endpoint itself, and can
also lead to privilege escalation to other organizational systems.
Traditional antivirus software is insufficient to block all modern forms of
malware, and more advanced approaches are developing to securing
endpoints, such as endpoint detection and response (EDR).
Lack of Encryption
Encryption processes encode data so that it can only be decoded by users with
secret keys. It is very effective in preventing data loss or corruption in case of
equipment loss or theft, or in case organizational systems are compromised by
attackers.
Unfortunately, this measure is often overlooked due to its complexity and lack
of legal obligations associated with proper implementation. Organizations are
increasingly adopting encryption, by purchasing storage devices or using cloud
services that support encryption, or using dedicated security tools.
Security Misconfiguration
Modern organizations use a huge number of technological platforms and tools,
in particular web applications, databases, and Software as a Service (SaaS)
applications, or Infrastructure as a Service (IaaS) from providers like Amazon
Web Services.
Enterprise grade platforms and cloud services have security features, but
these must be configured by the organization. Security misconfiguration due
to negligence or human error can result in a security breach. Another problem
is “configuration drift”, where correct security configuration can quickly
become out of date and make a system vulnerable, unbeknownst to IT or
security staff.
Organizations can mitigate security misconfiguration using technological
platforms that continuously monitor systems, identify configuration gaps, and
alert or even automatically remediate configuration issues that make systems
vulnerable.
data systems
Poses a threat to the availability and
integrity of sensitive data
Poses a threat to the confidentiality
of sensitive data.
May result in damage to organizational
systems.
Does not directly cause damage to
organizational systems.
Victims typically know about the attack Victims typically do not know about
the attack.
Main security focus is on detection and
mitigation.
Main security focus is on prevention.
Information Security and Data Protection Laws
Information security is in constant interaction with the laws and regulations of
the places where an organization does business. Data protection regulations
around the world focus on enhancing the privacy of personal data, and place
restrictions on the way organizations can collect, store, and make use of
customer data.
Data privacy focuses on personally identifiable information (PII), and is
primarily concerned with how the data is stored and used. PII includes any
data that can be linked directly to the user, such as name, ID number, date of
birth, physical address, or phone number. It may also include artifacts like
social media posts, profile pictures and IP addresses.
Data Protection Laws in the European Union (EU): the GDPR
The most known privacy law in the EU is the General Data Protection
Regulation (GDPR). This regulation covers the collection, use, storage, security
and transmission of data related to EU residents.
The GDPR applies to any organization doing business with EU citizens,
regardless of whether the company itself is based inside or outside the
European Union. Violation of the guidelines may result in fines of up to 4% of
global sales or 20 million Euro.
The main goals of the GDPR are:
Setting the privacy of personal data as a basic human right
Implementing privacy criteria requirements
Standardization of how privacy rules are applied
GDPR includes protection of the following data types:
Personal information such as name, ID number, date of birth, or address
Web data such as IP address, cookies, location, etc.
Health information including diagnosis and prognosis
Biometric data including voice data, DNA, and fingerprints
Private communications
Photos and videos
Cultural, social or economic data
Was this document helpful?
Information Security
Subject: Information Technology
362 Documents
Students shared 362 documents in this course
Degree:
FET
Was this document helpful?
Information Security: The Ultimate
Guide
What is Information Security (InfoSec)?
Information security (sometimes referred to as InfoSec) covers the tools and
processes that organizations use to protect information. This includes policy
settings that prevent unauthorized people from accessing business or personal
information. InfoSec is a growing and evolving field that covers a wide range
of fields, from network and infrastructure security to testing and auditing.
Information security protects sensitive information from unauthorized
activities, including inspection, modification, recording, and any disruption or
destruction. The goal is to ensure the safety and privacy of critical data such
as customer account details, financial data or intellectual property.
The consequences of security incidents include theft of private information,
data tampering, and data deletion. Attacks can disrupt work processes and
damage a company’s reputation, and also have a tangible cost.
Organizations must allocate funds for security and ensure that they are ready
to detect, respond to, and proactively prevent, attacks such
as phishing, malware, viruses, malicious insiders, and ransomware.
Whitepaper: Meeting Data Security Challenges in the Age of Digital
Transformation.
What are the 3 Principles of Information Security?
The basic tenets of information security are confidentiality, integrity and
availability. Every element of the information security program must be
designed to implement one or more of these principles. Together they are
called the CIA Triad.
Confidentiality
Confidentiality measures are designed to prevent unauthorized disclosure of
information. The purpose of the confidentiality principle is to keep personal
Discover more from:
- Discover more from:
