| Term | Definition |
|---|---|
Components of Information Security | Confidentiality
Integrity
Availability |
Confidentiality | Keeping information private and only sharing it with people who are authorized to access it |
Integrity | Ensuring information is accurate, complete, and has not been changed or altered without authorization |
Availability | Ensuring information and systems are accessible to authorized users when they need them |
CIA Triad | The standard is based on three characteristics that describe the attributes of information that are important to protect: confidentiality, integrity, and availability |
CIA Triad data & services issues | The threats to the confidentiality, integrity, and availability of information have evolved into a vast collection of events, including
accidental or intentional damage, destruction, theft, unintended or unauthorized modification, or other misuse from human or nonhuman threats |
Key Information Concepts - Access | The ability of authorized users to view, use, or modify information and systems based on their permissions |
Key Information Concepts - Asset | Anything valuable to an organization that needs to be protected, such as data, computers, software, or equipment |
Key Information Concepts - Attack | An attempt to harm, disrupt, or gain unauthorized access to a system, network, or data |
Key Information Concepts - Control, safeguard, or countermeasure | A security measure used to protect systems and information from threats and risks |
Key Information Concepts - Exploit | Taking advantage of a weakness in a system to gain unauthorized access or cause harm |
Key Information Concepts - Exposure | The potential for information or systems to be harmed, accessed, or compromised by a threat |
Key Information Concepts - Loss | The damage or negative impact that occurs when an asset is harmed, stolen, or compromised |
Key Information Concepts - Protection profile or security posture | The overall level of security an organization has to protect its systems, information, and assets from threats |
Key Information Concepts - Risk | The possibility that a threat will exploit a weakness and cause harm or loss to an organization’s systems or information |
Key Information Concepts - Subjects and objects | A subject is a person or system that accesses a resource, while an object is the information or resource being accessed |
Key Information Concepts - Threat | Anything that could exploit a weakness and cause harm to a system, network, or information |
Key Information Concepts - Threat agent | A person, group, or event that can carry out a threat and cause harm to a system or information |
Key Information Concepts - Threat event | An action or incident that could cause harm to a system, network, or information |
Key Information Concepts - Threat source | The person, situation, or circumstance that creates the potential for harm to a system or information. |
Key Information Concepts - Vulnerability - backdoor | A hidden way to bypass normal security controls and gain access to a system |
Characteristics of Information | Confidentiality
Integrity
Availability
Accuracy
Authenticity
Utility
Possession |
Accuracy | Ensuring information is correct and free from errors |
Authenticity | Ensuring that information, users, or systems are genuine and are who or what they claim to be. |
Utility | The usefulness or value of information or a system in helping someone accomplish a task or goal |
Possession | Having control or custody of information or an asset, even if you do not own it or have permission to use it |
Balancing Information Security and Access for perfection | Impossible to obtain perfect information security because it's a process |
What is the balance for Information Security and Access ? | Should be a balance between protection and availability |
How can you achieve balance for Information Security and Access ? | The level of security must allow reasonable access yet to protect against threats |
Bottom-up approach | A security approach that starts by fixing individual system weaknesses and building up to overall security |
Top-down approach | A security approach where management sets security policies and goals, which are then implemented throughout the organization |
Key advantage of Down-up approach | Technical expertise of individual administrators |
Grassroots effort | A security effort started by employees or IT staff at lower levels of an organization rather than by top management |
Disadvantages of Down-up approach | Lack of Participant support
Lack of Organizational staying power |
What does management do in Top-down approach? | Issue policy, procedures, and processes
Dictate goals and expected outcomes of project
Determine accountability for each required action |
What is the most successful type of Top-down approach? | Systems development life cycle |
Systems development life cycle | A step-by-step process used to plan, develop, test, implement, and maintain an information system |
What is the key component of an organization? | Senior management support |
Who's involved in senior management? | CIO - Chief Information Officer
CISO - Chief Information Security Officer |
CIO - Chief Information Officer | The executive responsible for managing an organization’s information technology and ensuring it supports business goals |
CISO - Chief Information Security Officer | The executive responsible for protecting an organization’s information, systems, and networks from security threats
Reports directly to CIO |
Who's involved in the Information security project team? | −Champion
−Team leader
−Security policy developers
−Risk assessment specialists
−Security professionals
−Systems administrators
−End users |
Champion | A person who supports and promotes a project or security initiative and encourages others to participate |
Team leader | The person responsible for guiding a team, assigning tasks, and ensuring the team meets its goals |
Security policy developers | Professionals who create rules and guidelines to protect an organization’s information, systems, and networks |
Risk assessment specialists | Professionals who identify, analyze, and evaluate potential risks to an organization’s systems, information, and assets |
Security professionals | Individuals responsible for protecting an organization’s information, systems, and networks from security threats and risks |
Systems administrators | IT professionals responsible for managing, maintaining, and securing an organization’s computer systems and networks |
End users | The people who directly use an information system or its applications to perform tasks |
Data owners | Senior management responsible for determining how data is classified, accessed, and protected within an organization |
Data custodian | Responsible for information and systems that process, transmit, and store it |
Data trustees | Individuals responsible for overseeing and protecting an organization’s data and ensuring it is used appropriately |
Data users | People who access and use an organization’s data to perform tasks or make decisions |
Advanced Persistent Threat (APT) | A long-term cyberattack in which skilled attackers secretly access a system and remain there to steal information or cause harm |
What cybersecurity disclosures must companies make in annual reports? | Report cybersecurity incidents promptly and disclose cybersecurity risks, strategy, and governance |
Which companies must follow the SEC’s cybersecurity disclosure rules? | Nearly all companies filing periodic SEC reports, including smaller companies and foreign private issuers |
When did the SEC cybersecurity disclosure rules take effect? | Incident reporting: December 18, 2023 (June 15, 2024 for smaller reporting companies)
Annual disclosures: For fiscal years ending on or after December 15, 2023 |
When must companies report a material cybersecurity incident? | Within four business days of determining the incident is material, using SEC Form 8-K |
What must companies disclose about a material cybersecurity incident on Form 8-K? | Nature, scope, & timing of the incident
Actual/potential impact on financial condition and operating results |
When must a company file an amended Form 8-K? | When required information about a material cybersecurity incident is missing or unavailable in the initial filing. |
When can a company delay reporting a cybersecurity incident? | When the U.S. Attorney General determines that disclosure poses a substantial risk to national security or public safety and notifies the SEC |
What must companies disclose about cybersecurity risk management? | The processes used to identify and manage cybersecurity risks, including whether third-party experts are involved |
What must companies disclose about the business impact of cybersecurity risks? | Whether cybersecurity risks have materially affected or may materially affect business strategy, operating results, or financial condition |
What must companies disclose about the board’s role in cybersecurity? | How the board of directors oversees cybersecurity risks |
What must companies disclose about management’s role in cybersecurity? | Who manages cybersecurity risks, their responsibilities, and their relevant expertise |