Accounting Essay 2 pages must answer all questions
noel001
romney_ais14_stppt_08.pptxAccounting Information Systems
Fourteenth Edition
Chapter 8
Controls for Information Security
Copyright © 2018 Pearson Education, Inc. All Rights Reserved
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
If this PowerPoint presentation contains mathematical equations, you may need to check that your computer has the following installed:
1) MathType Plugin
2) Math Player (free versions available)
3) NVDA Reader (free versions available)
1
Learning Objectives (1 of 2)
Explain how security and the other four principles in the Trust Services Framework affect systems reliability.
Explain two fundamental concepts; why information security is a management issue, and the time-based model of information security.
Discuss the steps criminals follow to execute a targeted attack against an organization’s information system.
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
2
Learning Objectives (2 of 2)
Describe the preventive, detective, and corrective controls that can be used to protect an organization’s information.
Describe the controls that can be used to timely detect that an organization’s information system is under attack.
Discuss how organizations can timely respond to attacks against their information system.
Explain how virtualization, cloud computing, and the Internet of Things affect information security.
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
3
Trust Services Framework
Security
Access to the system and data is controlled and restricted to legitimate users.
Confidentiality
Sensitive organizational data is protected.
Privacy
Personal information about trading partners, investors, and employees are protected.
Processing integrity
Data are processed accurately, completely, in a timely manner, and only with proper authorization.
Availability
System and information are available.
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
4
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
5
Security Life Cycle
Security is a management issue
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
Security Approach
Time-based model, security is effective if:
P > D + C where
P is time it takes an attacker to break through preventive controls
D is time it takes to detect an attack is in progress
C is time it takes to respond to the attack and take corrective action
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
7
Understanding Targeted Attacks
Conduct reconnaissance
Attempt social engineering
Scan and map the target
Research
Execute the attack
Cover tracks
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
8
How to Mitigate Risk of Attack
Preventive Controls
Detective Controls
People
Process
IT Solutions
Physical security
Log analysis
Intrusion detection systems
Continuous monitoring
Response
Computer Incident Response Teams (CIRT)
Chief Information Security Officer (CISO)
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
Preventive: People
Culture of security
Tone set at the top with management
Training
Follow safe computing practices
Never open unsolicited e-mail attachments
Use only approved software
Do not share passwords
Physically protect laptops/cellphones
Protect against social engineering
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
Preventive Process: User Access Controls
Authentication—verifies the person
Something person knows
Something person has
Some biometric characteristic
Combination of all three
Authorization—determines what a person can access
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
11
Preventive Process: Change Controls and Change Management
Formal process used to ensure that modifications to hardware, software, or processes do not reduce systems reliability
Good change management and control requires
Documentation
Approval
Testing
Develop “backout” plan
Monitoring
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
12
Preventive: IT Solutions
Antimalware controls
Network access controls
Device and software hardening controls
Encryption
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
Preventive: Physical Security: Access Controls
Physical security access controls
Limit entry to building
Restrict access to network and data
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
Detecting Attacks
Log Analysis—examining logs to identify evidence of possible attacks
Intrusion Detection Systems (IDSs) —system that creates logs of network traffic that was permitted to pass the firewall and then analyzes those logs for signs of attempted or successful intrusions
Continuous Monitoring—employee compliance with organization’s information security policies and overall performance of business processes
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
Responding to Attacks
Computer Incident Response Team (CIRT)
Chief Information Security Officer (CISO)
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
Security Implications of Virtualization, Cloud Computing, and the Internet of Things
Virtualization and Cloud Computing
Positive impact on security
Implementing strong access controls is good security over all the systems
Negative impact on security
Reliability issues
Risk of theft or destruction if unsupervised physical access
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
17
Key Terms
Time-based model of security
Defense-in-depth
Social engineering
Authentication
Biometric identifier
Multifactor authentication
Multimodal authentication
Authorization
Access control matrix
Compatibility test
Penetration test
Change control and change management
Border router
Firewall
Demilitarized zone (DMZ)
Routers
Access control list (ACL)
Packet filtering
Deep packet inspection
Intrusion prevention system
Endpoints
Vulnerabilities
Vulnerability scanners
Exploit
Patch
Patch management
Hardening
Log analysis
Intrusion detection system (IDS)
Computer incident response team (CIRT)
Virtualization
Cloud Computing
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
18
Copyright © 2018 Pearson Education, Inc.
Chapter 8: Controls for Information Security
Slide 1 - ‹#›
19
