CSE 4482: Computer Security Management: Assessment and Forensics

CSE 4482: Computer Security Management: Assessment and Forensics Instructor: Suprakash Datta (datta[at]cse.yorku.ca) ext 77875 Lectures: Tues (CB 122), 7–10 PM Office hours: Wed 3-5 pm (CSEB 3043), or by appointment. Textbooks: 1. "Management of Information Security", M. E. Whitman, H. J. Mattord, Nelson Education / CENGAGE Learning, 2011, 3rd Edition 2. "Guide to Computer Forensics and Investigations", B. Nelson, A. Phillips, F. Enfinger, C. Steuart, Nelson Education / CENGAGE Learning, 2010, 4th Edition. 02/04/23 1

CSE 4482: Administrivia Described in more detail on webpage http://www.cse.yorku.ca/course/4482 Grading: 1. Midterm (25%): dates, syllabus TBA. 2. Final (40%): To be scheduled by the registrar's office. Syllabus - TBA. 3. Assignments (20%): 3 written assignments and 2 labs, 4% each. 4. Project (15%): details will appear on the webpage. 02/04/23 2

CSE 4482: More administrivia Plagiarism: Will be dealt with very strictly. Read the detailed policies on the webpage. Grades: will be on ePost. Slides: Will usually be on the web the day following the class. The slides are for MY convenience and for helping you recollect the material covered. They are not a substitute for, or a comprehensive summary of, the book. Webpage: All announcements/handouts will be published on the webpage -- check often for updates) 02/04/23 3

The Big Picture Technology vs Management Planning in Technology and Management Management vs leadership Many of the following slides are adapted from the authors’ slides. 02/04/23 4

Learning outcomes Upon completion of this chapter, you should be able to: – Describe the importance of the manager’s role in securing an organization’s use of information technology, and understand who is responsible for protecting an organization’s information assets – Enumerate and discuss the key characteristics of information security – Enumerate and define the key characteristics of leadership and management – Differentiate information security management from general management 02/04/23 5

Information Systems A healthcare example, from http://wiki.ihe.net/images/b/b6/CareManagementDiagram.jpg Components: Hardware Networks Software Data Procedures Policies Personnel 6

Information Security The concept of computer security has been replaced by the concept of information security – Covers a broad range of issues From protection of data to protection of human resources Information security is no longer the sole responsibility of a discrete group of people in the company – It is the responsibility of every employee, especially managers 02/04/23 7

Funding and Planning for Security Information security decisions should involve three distinct groups of decision makers (communities of interest) – Information security managers and professionals – Information technology managers and professionals – Non-technical business managers and professionals 02/04/23 8

Information Security Communities InfoSec community –Protects the organization’s information assets from the threats they face. IT community Supports the business objectives of the organization by –supplying and supporting information technology –appropriate to the business needs Non-technical general business community –Articulates and communicates organizational policy and objectives and allocates resources to the other groups 9

What is Security ? Definition: “the quality or state of being secure —to be free from danger” Security is often achieved by means of several strategies undertaken simultaneously or used in combination with one another Specialized areas of security –Physical security –operations security, –communications security, and –network security 10

What is Information Security ? Information security –The protection of information and its critical elements (confidentiality, integrity and availability), including the systems and hardware that use, store, and transmit that information –Achieved through the application of policy, technology, and training and awareness programs 11

An Information Security Model C C.I.A. triangle – Confidentiality, integrity, and availability – Has expanded into a more comprehensive list of critical characteristics of information 12

Confidentiality The characteristic of information whereby only those with sufficient privileges may access certain information Measures used to protect confidentiality – Information classification – Secure document storage – Application of general security policies – Education of information custodians and end users 13

Integrity The quality or state of being whole, complete, and uncorrupted Information integrity is threatened – If exposed to corruption, damage, destruction, or other disruption of its authentic state Corruption can occur while information is being compiled, stored, or transmitted 14

Availability The characteristic of information that enables user access to information in a required format, without interference or obstruction – A user in this definition may be either a person or another computer system – Availability does not imply that the information is accessible to any user Implies availability to authorized users 15

Other key concepts Privacy – Information collected, used, and stored by an organization is to be used only for the purposes stated to the data owner at the time it was collected – Privacy as a characteristic of information does not signify freedom from observation Means that information will be used only in ways known to the person providing it 16 Management of Information Security, 3rd Edition

Other key concepts (contd) Identification – An information system possesses the characteristic of identification when it is able to recognize individual users – Identification and authentication are essential to establishing the level of access or authorization that an individual is granted Authentication – Occurs when a control proves that a user possesses the identity that he or she claims 17 Management of Information Security, 3rd Edition

Other key concepts (contd) Authorization – Assures that the user has been specifically and explicitly authorized by the proper authority to access, update, or delete the contents of an information asset – User may be a person or a computer – Authorization occurs after authentication Accountability – Exists when a control provides assurance that every activity undertaken can be attributed to a named person or automated process 18 Management of Information Security, 3rd Edition

A more general security model CNSS Security Model – – – – Also known as the McCumber Cube Provides a more detailed perspective on security Covers the three dimensions of information security Document available at http://www.cnss.gov/Assets/pdf/ nstissi 4011.pdf 19 Management of Information Security, 3rd Edition

CNSS Security Model Figure 1-1 Components of Information security 20 Management of Information Security, 3rd Edition Source: Course Technology/Cengage Learning

CNSS Security Model (contd) Figure 1-2 CNSS security Model 21 Management of Information Security, 3rd Edition Source: Course Technology/Cengage Learning

CNSS Security Model (contd) Drawbacks – Omits discussion of detailed guidelines and policies that direct the implementation of controls – Weakness of this model emerges if viewed from a single perspective Need to include all three communities of interest 22 Management of Information Security, 3rd Edition

What Is Management? The process of achieving objectives using a given set of resources Manager – Someone who works with and through other people by coordinating their work activities in order to accomplish organizational goals Q: Who manages the CSE department? 23 Management of Information Security, 3rd Edition

What is Management? (cont’d.) Managerial roles – Informational role Collecting, processing, and using information that can affect the completion of the objective – Interpersonal role Interacting with superiors, subordinates, outside stakeholders, and other parties that influence or are influenced by the completion of the task – Decisional role Selecting from among alternative approaches, and resolving conflicts, dilemmas, or challenges 24 Management of Information Security, 3rd Edition

Leaders vs Managers Leaders – Influence employees to accomplish objectives – Lead by example; demonstrating personal traits that instill a desire in others to follow – Provide purpose, direction, and motivation to those that follow Managers – Administers the resources of the organization – Creates budgets, authorizes expenditures and hires employees 25 Management of Information Security, 3rd Edition

Behavioral Types of Leaders Three basic behavioral types of leaders – Autocratic – Democratic – Laissez-faire 26 Management of Information Security, 3rd Edition

Management Characteristics Two basic approaches to management – Traditional management theory Uses the core principles of planning, organizing, staffing, directing, and controlling (POSDC) – Popular management theory Categorizes the principles of management into planning, organizing, leading, and controlling (POLC) 27 Management of Information Security, 3rd Edition

Management Characteristics (cont’d.) Figure 1-3 The planning-controlling link Notice the feedback loop Management of Information Security, 3rd Edition 28 Source: Course Technology/Cengage Learning (adapted from Jourdan, 2003)

Management Characteristics (cont’d.) Planning – The process that develops, creates, and implements strategies for the accomplishment of objectives Three levels of planning – Strategic, tactical, and operational Planning process begins with the creation of strategic plans for the entire organization 29 Management of Information Security, 3rd Edition

Management Characteristics (cont’d.) An organization must thoroughly define its goals and objectives – Goals are the end results of the planning process – Objectives are intermediate points that allow you to measure progress toward the goal 30 Management of Information Security, 3rd Edition

Management Characteristics (cont’d.) Organizing – The management function dedicated to the structuring of resources to support the accomplishment of objectives – Requires determining what is to be done, in what order, by whom, by which methods, and according to what timeline 31 Management of Information Security, 3rd Edition

Management Characteristics (cont’d.) Leading – Leadership encourages the implementation of the planning and organizing functions Includes supervising employee behavior, performance, attendance, and attitude – Leadership generally addresses the direction and motivation of the human resource 32 Management of Information Security, 3rd Edition

Management Characteristics (cont’d.) Controlling – Monitoring progress toward completion – Making necessary adjustments to achieve the desired objectives The control function serves to assure the organization of the validity of the plan – Determines what must be monitored as well as applies specific control tools to gather and evaluate information 33 Management of Information Security, 3rd Edition

Possible algorithm Figure 1-4 The control process 34 Management of Information Security, 3rd Edition Source: Course Technology/Cengage Learning

Solving Problems Step 1: Recognize and define the problem Step 2: Gather facts and make assumptions Step 3: Develop possible solutions Step 4: Analyze and compare possible solutions Step 5: Select, implement, and evaluate a solution Q: Where is the feedback loop? 35 Management of Information Security, 3rd Edition

Principles of Information Security Management The extended characteristics of information security are known as the six P’s – Planning – Policy – Programs – Protection – People – Project Management 36 Management of Information Security, 3rd Edition

Planning Planning as part of InfoSec management – An extension of the basic planning model discussed earlier in this chapter Included in the InfoSec planning model – Activities necessary to support the design, creation, and implementation of information security strategies 37 Management of Information Security, 3rd Edition

Planning (cont’d.) Types of InfoSec plans – Incident response planning – Business continuity planning – Disaster recovery planning – Policy planning – Personnel planning – Technology rollout planning – Risk management planning – Security program planning includes education, training and awareness 38 Management of Information Security, 3rd Edition

Policy The set of organizational guidelines that dictates certain behavior within the organization Three general categories of policy – Enterprise information security policy (EISP) – Issue-specific security policy (ISSP) – System-specific policies (SysSPs) 39 Management of Information Security, 3rd Edition

Programs InfoSec operations that are specifically managed as separate entities – Example: a security education training and awareness (SETA) program Other types of programs – Physical security program complete with fire, physical access, gates, guards, etc. The National Institute of Standards and Technology has published guidelines for information technology security training requirements, which may be found on the Web at: http://csrc.nist.gov /groups/SMA/ate/index.html 40 Management of Information Security, 3rd Edition

Protection Executed through risk management activities – Including risk assessment and control, protection mechanisms, technologies, and tools – Each of these mechanisms represents some aspect of the management of specific controls in the overall information security plan 41 Management of Information Security, 3rd Edition

People – The most critical link in the information security program – Managers must recognize the crucial role that people play in the information security program – This area of InfoSec includes security personnel and the security of personnel, as well as aspects of a SETA program 42 Management of Information Security, 3rd Edition

Project Management – Identifying and controlling the resources applied to the project – Measuring progress – Adjusting the process as progress is made 43 Management of Information Security, 3rd Edition

Project Management (cont’d.) Information security is a process, not a project – Each element of an information security program must be managed as a project – A continuous series, or chain, of projects Some aspects of information security are not project-based – They are managed processes (operations) 44 Management of Information Security, 3rd Edition

Project Management (cont’d.) Figure 1-4 The information security program chain 45 Management of Information Security, 3rd Edition Source: Course Technology/Cengage Learning

Project Management (cont’d.) Project Management – The application of knowledge, skills, tools, and techniques to project activities to meet project requirements – Accomplished through the use of processes Such as initiating, planning, executing, controlling, and closing – Involves the temporary assemblage resources to complete a project – Some projects are iterative, occurring regularly 46 Management of Information Security, 3rd Edition