Title: Class Outline 2
Course: KVCC BUS118 > Section: Class Outlines

1.      What is Information Security?

a.      The book definition – the study and practice of protecting information

2.      Who should be concerned with Information Security?

3.      Why is it a concern?

4.      Confidentiality – this is the ensuring that only those that are supposed to have the rights to view the information are able to access it. The keyword here is access.

a.      Methods to ensure

i.           Encryption

ii.           Access controls

b.      Methods to compromise

i.           Shoulder Surfing

ii.           Social Engineering

iii.           Accidents

5.      Integrity – ensures that the information that is stored is accurate and any ability to change is controlled.

a.      Methods to ensure

i.           Information verification

ii.           Permissions

b.      Methods to compromise

i.           Accidents

ii.           Internal threats

iii.           External threats

6.      Availability – ensures that the information is accessible when needed.

a.      Methods to ensure

i.           Risk and Contingency planning

ii.           Removing single points of failure/being redundant

b.      Methods to compromise

i.           Denial of service attack

ii.           Outages

7.      Domains of IT infrastructure

a.      User

b.      Workstation

c.      LAN

d.      WAN

e.      LAN to WAN

f.       Remote Access

g.      System/Application

8.      Vulnerabilities – a weakness or flaw in the system

a.      People

i.           Separation of duties – one person knows too much about a critical process.

b.      Process

c.      Facility

d.      Technology

9.      Exploits – attacks that focus on vulnerabilities

a.      0-day – attacks that exploit vulnerabilities before they can be patched.

10.  Threats – anything that can bring harm to a business information system

a.      Human

b.      Natural

c.      Technological and Operational

d.      Physical and Environmental

11.  Risk – the likelihood that a threat will exploit a vulnerability and cause harm.

a.      Risk Avoidance –applying safeguards to avoid negative effects

b.      Risk Mitigation – lowering the risk to an acceptable standard

c.      Risk Transfer – the passing on of risk to somewhere else

d.      Risk Acceptance – deciding to do nothing about risk essentially ignoring it.

12.  Safeguard – reducing the harm from threats and vulnerabilities

a.      Administrative

b.      Technical

c.      Physical

13.  Common Concerns

a.      Shoulder Surfing

b.      Social Engineering

c.      Phishing

d.      Malware

e.      Spyware/Key loggers

f.       Logic Bombs

g.      Backdoors

h.      Denial of service attack

14.  Classifications of Data

a.      Confidential

b.      Public

c.      Secret

d.      Top Secret

15.  Mechanisms that ensure information Security

a.      Laws

b.      Contracts

c.      Organizational Governance

d.      Voluntary Organizations

16.  Laws that govern specific categories of data

Attached Files: | - KVCC BUS118_LegalAspectsBusInfoSys_Class Outlline 2(1).pdf