Security & Control design

Security & Control design

1. Cybersecurity: governance development management & use of information security & IT to ensure safe cyber environment

   • Need be: non-repudiable: ability to prove action occurred, accountable: trace who did it, authentic: info is trustworthy, reliable: consistent results
   • Threats: ransomware, phishing Vulnerbilities: info, IT. Assets: people & interests
   • Cybercrime: violation of laws relate to use of ICT. Can be logical (access sys and sabotage or harm), physical(theft) and social(deceive indiv w aim of getting personal info)
     • Defence strats: encryption, access controls, back up, SSO, content filtering, auditing
     • Roles, Responsibilities, Consulting, Informed (RACI): who is assigned to do the work, who makes the final decision & has ultimate ownership, who must be consulted before decsiion made, who must be informed decsion made
   • General controls: relate to all applications used in biz, estabish a framework for controlling the design, security and use of applications
     • systems maintenence: plociies, profecdues for ensuring sys maintined, disaster recover: restoring biz to full op when disaster occurs, data manag: controls implem to ensure data quality & integrity w/o redundancy, application controls: controls unique to ach appl
       • service level agreement(SLA): process for org to specofy perfrmce rq, encryption, segregation of duties
       • input cntrols: prvent etry of incomplete, erroneous or innapropriate data into IS, contols ust ensure the follwoing: 1)accuracy of data 2) completeness of input 3) validation of input
         • Processing controls: ensures processing does not contain errors. Inlcudes 1) CROSSFOTTING 2)EASONABLE CHEC 3)RONDING OFF 4) functional checks
         • databse controls: 1) backup & recovery 2) file handling controls 3) access authorisation
           • telecomm controls: most . vulnerbale comp of IS, need to encrypt for when inof intercepted

2. Information security: CIA Triad

   • Confidentiality: authorised users, limits access to information
   • Integrity: trustworthy and accurate info
   • Availability: guarantee of reliable access

3. Operation technology security: hardware & software that detects or causes a change through monitoring and control of physical devices or processes

   • Offensive security: a proactive defence strategy used by managers to try mitigate security incidents eg. penetration testing

4. Layers of cyber environment (from inner most concentric circle)

   • Data: info stored on a system , Application: where user can access system, Host: physical sys where info is stored and view on, Internal network: all devices connected to local network in an org, external network: platform where orgs can interact w each other

5. Forensics: use of scientifically derived & proven methods for preservation, collection, validation and interpretation of evidence derived from various sources for purpose of furthering reconstruction of events that are criminal

   • Cyber forensics: digital evidence, digital sources, digital crimes, after the fact reconstuction

6. Security operations centre: centralised security facility either purchased or implemented internally. Goal is to improve security function of an org by detecting and responding to threats, operates 24 hours, seperate networks & systems

7. Security management: (top of pyramid= strategic)Scenario planning- identify and pre-empt possible economic impacts, environmental scanning- proactively assessing biz trends & events within op eniron, buisiness strategy- biz assess to identify areas of concern, Peer networking- entails sharing security intel threats

   • (tactical bottom end of pyramid)= tech utilisation- recommends orgs investigate new tech to be proact against threats, threat & vulnerability intelligence: services provide org w ability to conduct risk man, process optimisation- through process formalisation enables org to measur, monitor &refine performance
   • Information Security policies(ISP): define attitude or org wrt use, protection, modification & destruction or orgs info. Such as access control, app contol, anti-virus, password policy.
     • Security Standards: no single standrad or formulae, collection of standrds and benchmarks to ensure best security practices are adoptem, guidleline and frameworks, International Org of Standard(ISO) and National Institute of Standards & Tech(NIST) provide well def standards

8. Management Issues: 1) time 2) cost 3) customer relations, employee awareness, skills- cybersecurity + cyber forensics, privacy- confidential org data, customer data, policy & law, incident management

9. IT GOVERNANCE FRAMEWORK: aligning IT &biz to maximise biz value via controls, methods, policies & procedures. ITIL, COBIT, ISO/IEC

   • INFORMATION TECHNOLOGY LIBRARY(ITIL): method for handling tech, communication, to satisy customer demand & improve supply by providers. 5 main phases of dev are: 1) service strategy 2) serv design 3)service transiton, operation, improvement
   • CONTROL OBJECTIVES FOR INFORMATION TECH(COBIT): used to manage ops & strategies related to IT ensuring compliance w regulations. 5 principles: 1)meetung staeholderneeds 2) covering ent end-to-end 3) applying single integrated framework 4) enabling holisyic approach 5) seperating governance from managment
   • 6 principles of ISO/ISEC: 1) Responsibility: 2) strategy: 3) acquisition 4) conformance 6) human beahviour: