Introduction to Information Security Management CIS 8080 Security and Privacy of Information and Information Systems Richard Baskerville Georgia State University 1 Principles Information Security Management Assumptions PFirst Principle: T-F-O model of information security P Second Principle: Incident-centered security management 2
Theory of Secure Information Systems Hoffman, L., Michelman, E., and Clements, D. "SECURATE - Security evaluation and analysis using fuzzy metrics," in: AFIPS National Computer Conference Proceedings, 1978, pp. 531-540. The natural relationship involves the association of potential intrusion activities associated with each member of the set of system objects. These threat-object relations defined a set of edges T i O j that manifest the components of insecurity or risk in systems. T 1 T 2 T 3 T 4 O 1 O 2 O 3 T n T O m O 3 Theory of Secure Information Systems The relationship between a set of system objects (each with a loss value), a set of threats (each with a likelihood), and a set of system security features (each with a resistance). In a protected system, all edges are instead prescribed in the form T i F k and F k O j that represents the insertion of security features between threats and system objects. T 1 T 2 T 3 T 4 F 1 F 2 F 3 O 1 O 2 O 3 T n F l O m T F O 4
Security Objects T 1 T 2 T 3 T 4 F 1 F 2 F 3 O 1 O 2 O 3 T n F l O m T F O 5 Types of Security Objects P Physical Assets < Computers and communications machinery < Attack with physical assaults PSoft Assets < Protocols and software < Attack with cracking and malicious code P Psychic Assets < Perceptions and information < Attack with data falsification 6
Security Threats T 1 T 2 T 3 T 4 F 1 F 2 F 3 O 1 O 2 O 3 T n F l O m T F O 7 Security Incidents Turnaround and transformation in cybersecurity Key findings from The Global State of Information Security Survey 2016, PricewaterhouseCoopers, p. 24, http://www.pwc.com/gx/en/issues/cyber-security/information-securitysurvey/download.html 8
Sources of Cyberthreats US cybersecurity: Progress stalled Key findings from the 2015 US State of Cybercrime Survey, PricewaterhouseCoopers. p. 4 9 Frequency of Data Breach Patterns 10 Verizon Risk Team. 2015. "2015 Data Breach Investigations Report." New York: Verizon, p. 31
Malicious Spam Cisco 2015 Annual Security Report, pp. 24-26. http://www.cisco.com/web/offer/gist_ty2_asset/cisco_2014_asr.pdf 11 Vulnerability: Expertise ISACA 2015 Global Cybersecurity Status Report www.isaca.org/cybersecurityreport 12
Industry Victims 13 Verizon Risk Team. 2015. "2015 Data Breach Investigations Report." New York: Verizon, p. 5 Cost of Information Security Turnaround and transformation in cybersecurity Key findings from The Global State of Information Security Survey 2016, PricewaterhouseCoopers, p. 25, http://www.pwc.com/gx/en/issues/cyber-security/information-securitysurvey/download.html 14
Cost per Compromised Record Verizon Risk Team. 2015. "2015 Data Breach Investigations Report." New York: Verizon, p. 28 15 Contrasts: Insider or Outsider? 16
Data Breach Actors 17 Verizon Risk Team. 2015. "2015 Data Breach Investigations Report." New York: Verizon, p. 4 Sources of Security Incidents Turnaround and transformation in cybersecurity Key findings from The Global State of Information Security Survey 2016, PricewaterhouseCoopers, p. 24, http://www.pwc.com/gx/en/issues/cyber-security/information-securitysurvey/download.html 18
Contrasts: Mobile/IoT Risks? 19 Non-adnoyance Mobile Malware Infections Verizon Risk Team. 2015. "2015 Data Breach Investigations Report." New York: Verizon, p. 19 20
Attacks on IoT Devices & Systems Turnaround and transformation in cybersecurity Key findings from The Global State of Information Security Survey 2016, PricewaterhouseCoopers, p. 11 http://www.pwc.com/gx/en/issues/cyber-security/information-securitysurvey/download.html 21 Security Features T 1 T 2 T 3 T 4 F 1 F 2 F 3 O 1 O 2 O 3 T n F l O m T F O 22
Security Features International Treaties Standards CobiT ISO 27002 ISO 27001 NIST Laws Institutions Security Policies & Organizations Practices & Safeguards 23 Regulatory Compliance Improves Security Applicable regulations from: 2010/2011 CSI Computer Security Survey 24
Double-Edged Complexity T 1 T 2 T 3 T 4 O 1 O 2 O 3 T n T O m O T 1 T 2 T 3 T 4 F 1 F 2 F 3 O 1 O 2 O 3 T n F l O m T F O 25 Incident-Centered Security Management Baskerville, R., Spagnoletti, P., and Kim, J. 2014. "Incident-Centered Information Security: Managing a Strategic Balance between Prevention and Response," Information & Management (51:1), pp 138-151. LEFT OF BANG RIGHT OF BANG t Prof. Merrill Warkentin of Mississippi State University recognized the conceptual value of this IED management approach for general security management. 26
Modes of Protection Prevention Response t 27 Different Action Paradigms Risk Management Forensics and Incident Response t 28
Model Assumptions 29 Logical Structure of Models 30
Organizing Principles 31 Interaction of Left & Right Paradigms Left of Incident Right of Incident Indications & Warnings Prevent Refine Information System Resource Contain, Recover, Harden Threat Incident Detect Respond Deter Legislate & Policy Setting Investigate, Notify, Sue, Prosecute, Retaliate Adapted from Denning, D. E. (1999). Information Warfare and Security. Reading Mass: Addison-Wesley. 32
Incidents Prevention Recovery t 33 Introduction to Information Security Management CIS 8080 Security and Privacy of Information and Information Systems Richard Baskerville Georgia State University 34