All
right, let's take a look at Module 3,
dealing with network security fundamentals.
First off, we're going to ask ourselves
this question, what is information security?
Definition, a state of wellbeing
of information and infrastructure in which the possibility of theft, tampering, and
disruption of information and services is kept low or tolerable.
Okay, well, who decides what is
acceptable, what is well being, what is low or is tolerable?
It starts off with senior management.
So ultimately senior management decides on
everything, what's acceptable, what's not acceptable.
Ultimately senior management is responsible for organizational security.
Ultimately it's their head of the chopping block if a data breach occurs.
Then they delegate off those responsibilities to us, the security
professionals, business unit managers, and so forth.
But it starts off being the responsibility
of the CEO, and then flows downward from there.
Will we ever be 100 % secure?
Not a chance.
We strive to accomplish or achieve reasonable protection.
Again, ultimately, senior management
decides what's reasonable and what's acceptable.
Establishing the need for security.
I mentioned this in a previous chapter,
but technology evolves based on ease of use and functionality.
So a selling point for a new novel
technology or product or whatever is not, look how secure it is.
It's what can this do?
How is it innovative?
What can it do for me?
Fun functionality and how easy is it to use?
I mentioned this before, you have to have
a balance between security and functionality and ease of use.
There's actually a triangle which
illustrates those three concepts coming up here in just a few slides.
We rely on the use of computers for
accessing, providing or just storing information.
Where does data get stored these days on computers, plain and simple.
Increased network environment, network based applications.
Everything is digitally controlled these days.
You're pretty hard pressed to think of something that is not in a digital format.
Everything is.
If it's on a computer system and I can talk to it, I can potentially attack it.
Some elements of information security.
We mentioned a couple of these earlier in brief definitions, but confidentiality is
pretty much protecting against unauthorized disclosure.
Integrity is protecting against improper modification.
Availability is making sure that resources
are available when and where they're needed by authorized individuals.
Authenticity is something being genuine or reliable.
We'll talk a little bit more about that here in a second.
Digital Signatures and then Nonremediation
is a guarantee that the sender cannot later deny having sent the message.
The recipient cannot deny having received the message.
Integrity typically gets associated with a hashing algorithm.
Authenticity and non repudiation are
typically associated with digital signatures.
Now, the difference between the two is that a digital signature is an
encrypted hash that's been encrypted with the private key of the signer.
Now, later on, we're going to talk about Asymetric Encryption.
We'll revisit that concept, but these are achieved through a digital Signature.
The hash for integrity, confidentiality,
availability, variety of mechanisms for that.
And again, we will be giving several
examples of each as we move through the later modules.
The security, functionality, and usability triangle.
I just mentioned we had a slide coming up here in a couple of slides.
A couple of slides is pretty much dead on.
But the functionality,
security and usability, the further you move towards one apex of
the triangle, the further you move away from the other two.
Generally, we think of a natural inversion between security and functionality, but
usability or ease of use is in there as well.
Security challenges.
Why do I have to secure?
I don't get compromised, but what drives that?
Compliance to government laws and regulations.
That's a big one. You secure to achieve compliance,
prevent fines and loss of reputation and so forth.
There's one challenge, the driving factor.
The lack of qualified and skilled cyber
security professionals, which is why we're in class.
Difficulty in centralizing security in a distributed computing environment because
you're putting everything in bits and pieces everywhere.
Fragmented and complex privacy and data protection regulations.
You got plenty of that, and that goes hand in hand with laws and regulations.
Compliance issues due to implementation of people bringing their own device to work.
Then relocation of sensitive data from
legacy data centers to the cloud without proper configuration.
Just to name a few. There's more than that.
That's just the short list.
Just to get our minds working on it.
The impact of information security attacks.
When you get breached, you lose money. There you go.
That's usually what it boils down to.
So eventually, the whole driving force for an organization's existence is what?
To make money.
That's not a bad thing.
Without money, which is the lifeblood of
any organization, you can't achieve all of those other mission statements and
objectives and improve quality of life, etc.
Make people's lives more convenient and easy.
At the end of the day, you're making money.
Without making money, you're no longer in business and other stuff happens.
The impact of an information security
attack will result in loss of money due to loss of confidentiality and integrity,
results in loss of trust, damage to the organization's reputation.
Large scale data breach, you're going to lose money.
Damaged customer relationships, you're going to lose money.
Loss of business reputation, you're going to lose money.
Legal and compliance issues, you may run
into fees and fines and operational impacts.
When a security breach occurs, it will
impact your bottom line either immediately or through some delayed
losses, and we're not going to get too much into the tangibles and the
intangibles right now, but at the end of the day, you lose dollar signs.