Topic 1 Quiz Notes
Topic 1 Quiz Notes IST-456
Popular in Information Security Management
Popular in Department
This 11 page Study Guide was uploaded by Matt Curtis on Monday February 2, 2015. The Study Guide belongs to IST-456 at Pennsylvania State University taught by Dr. Gerry Santoro in Spring2015. Since its upload, it has received 384 views.
Reviews for Topic 1 Quiz Notes
Report this Material
What is Karma?
Karma is the currency of StudySoup.
You can buy or earn more Karma at anytime and redeem it for class notes, study guides, flashcards, and more!
Date Created: 02/02/15
Matthew Curtis 2 February 2015 IST 456 Topic 1Introduction to Management of Information Security Introduction 0 Information Technology 0 Stores processes and transports information from one business unit to another 0 Concept of computer security has evolved into concept of information security 0 Issues Covered I Data Protection l Protection of human resources 0 Information Security 0 No longer sole responsibility of the IT Security group 0 Responsibility of EVERYONE 0 Communities of Interest 0 Security Professionals SP l Provides protection to company assets 0 Information Technology Professionals IT I Provides support to organizations with information needs 0 NonTechnical Business Professionals Users l Communicates organizational policy and objectives l Allocates resources to other groups I Provides business infrastructure What is Security 0 Security 0 The quality or state of being secureto be free from danger O Often requires several strategies to be successful 0 Specialized Areas of Security 0 Physical security operations security communications security and network security 0 Information Security 0 The protection of information and its critical elements confidentiality integrity and availability including the systems and hardware that use store and transmit that information 0 Policy training and awareness programs and technology are Vital concepts CNSS Security Model ICIA Triangle 0 Confidentiality O Integrity 0 Availability 0NSTISSC CNSS Security Model 0 Known as McCumber Cube 0 Provides detailed perspective on security Covers three dimensions of information security Omits discussions of detailed guidelines and policies Direct the implementation of controls Weakness is if this model is viewed from a single perspective I Need all 3 communities included 0000 Kev Concepts of Information Security 0Confidentiality 0 Requires users to have permission to access certain information 0 Information Security I Secure document storage I Application of general security policies I Education of information custodians and end users 0 Integrity 0 The quality or state of being whole complete and uncorrupted 0 Information integrity is threatened I Exposed to corruption damage destruction or other disruption of its authentic state I Corruption can occur while information is being compiled stored or transmitted 0 Availability 0 Enables user access to information in a required format without interference or obstruction 0 User can be a person or another computer system 0 Availability DOES NOT imply that information is accessible to everyone 0 Privacy 0 Information collected used and stored by an organization is to be used only for the purposes stated to the data owner at the time it was collected 0 DOES NOT signify information is freedom from observation 0 Means information will be used in ways known to the user providing it 0 Identification 0 Information system that is able to recognize individual users 0 Essential to availability and user privacy along with authentication 0 Authentication O Occurs when a control proves that a user possesses the identity that he or she claims 0 Authorization O Assures that the user has been specifically and explicitly authorized by the proper authority to access update or delete the contents of an information asset 0 User may be a person or a computer 0 Authorization occurs after authentication 0 Accountability 0 Exists when a control provides assurance that every activity undertaken can be attributed to a named person or automated process 0 Acts as a sort of Checks and Balances system to ensure identification of users What Is Management 0 The process of achieving objectives using a given set of resources 0 Manager 0 Someone who works with and through other people by coordinating their work activities in order to accomplish organizational goals 0 Administers the resources of the organization Creates budgets authorizes expenditures and hires employees 0 Managerial roles 39 0 Collecting processing and using information that can affect the O completion of the objective 0 Interacting with superiors subordinates outside stakeholders and other parties that in uence or are in uenced by the completion of the task 0 Selecting from among alternative approaches and resolving con icts dilemmas or challenges 0 Leaders 0 In uence employees to accomplish objectives 0 Lead by example demonstrating personal traits that instill a desire in others to follow 0 Provide purpose direction and motivation to those that follow Behavioral Types of Leaders 0 Three basic behavioral types of leaders 0 Autocratic 0 Democratic O Laissezfaire Management Characteristics 0 Two basic approaches to management 0 Uses the core principles of planning organizing staffing directing and controlling POSDC Not as common Categorizes the principles of management into planning organizing leading and controlling POLC More popular 0 PlanningControlling Link 0 Planning The process that develops creates and implements strategies for the accomplishment of objectives Three Levels 0 Strategic 0 Tactical 0 Operational Goals 0 End results of the planning process Objectives 0 Intermediate points that allow you to measure progress toward the goal Strategies Plans 0 Organizing The management function dedicated to the structuring of resources to support the accomplishment of objectives Structure 0 Requires determining what is to be done in what order by whom by which methods and according to what timeline Human Resources Management 0 Leading Encourages the implementation of the planning and organizing functions 0 Includes supervising employee behavior performance attendance and attitude Generally addresses the direction and motivation of the human resource Motivation Leadership Communication Individual I Group Behavior 0 Controlling I Monitoring progress toward completion I Making necessary adjustments to achieve the desired objectives I Serves to assure the organization of the validity of the plan I Determines what must be monitored as well as applies specific control tools to gather and evaluate information I Standards I Measurements I Comparisons I Action Solving Problems 0 Recognize and define the problem I Gather facts and make assumptions 0 Develop possible solutions 0 Analyze and compare possible solutions 0 Se1ect implement and evaluate a solution Principles of Information Security Management 0 The extended characteristics of information security are known as the 0 Planning I Activities necessary to support the design creation and implementation of information security strategies I Types of InfoSec Plans 0 Incident response planning 0 Business continuity planning 0 Disaster recovery planning 0 Policy planning 0 Personnel planning 0 Technology rollout planning 0 Risk management planning 0 Security program planning 0 Includes education training and awareness 0 Policy I The set of organizational guidelines that dictates certain behavior within the organization I Three general categories of policy 0 Enterprise information security policy EISP I Issuespecific security policy ISSP I Systemspecific policies SysSPs Programs I InfoSec operations that are specifically managed as separate entities I Example a security education training and awareness SETA program I Physical security program 0 Complete with fire physical access gates guards etc Protection I Executed through risk management activities 0 Including risk assessment and control protection mechanisms technologies and tools 0 Each of these mechanisms represents some aspect of the management of specific controls in the overall information security plan People I The most critical link in the information security program I Managers must recognize the crucial role that people play in the information security program Project Management I Identifying and controlling the resources applied to the project I Measuring progress I Adjusting the process as progress is made I Information security is a process not a project 0 Each element of an information security program must be managed as a project 0 A continuous series or chain of projects I Some aspects of information security are not project based 0 They are managed processes operations I The application of knowledge skills tools and techniques to project activities to meet project requirements I Accomplished through the use of processes 0 Such as initiating planning executing controlling and closing I Involves the temporary assemblage resources to complete a project I Some projects are iterative occurring regularly Applying Proiect ngement to Securitv First identify an established project management methodology PMBoK is considered the industry best practice PMBoK Knowledge Areas Project integration management 0 Includes the processes required to coordinate occurs between components of a project 0 Elements of a project management effort that require integration 0 The development of the initial project plan 0 Monitoring of progress during plan execution 0 Control of plan revisions 0 Control of the changes made to resource allocations I As measured performance causes adjustments to the project plan 0 Project plan development 0 The process of integrating all of the project elements into a cohesive plan I Goal is to complete the project Within the allotted work time using no more than the allotted project resources 0 Core components of project plan 0 Work time resources and project deliverables 0 Changing one element affects the other two I Likely requires revision of the plan Work time Project plan Project deliverables Resources 0 0 When integrating the disparate elements of a complex information security project complications are likely to arise O Con icts among communities of interest 0 Farreaching impact 0 Resistance to new technology Project scope management 0 Ensures that project plan includes only those activities necessary to complete it Scope 0 The quantity or quality of project deliverables Major processes 0 Initiation scope planning definition verification and change control Project time management 0 Ensures that project is finished by identified completion date while meeting objectives 0 Failure to meet project deadlines is among most frequently cited failures in project management I Many missed deadlines are caused by poor planning 0 Includes following processes I Activity definition I Activity sequencing I Activity duration estimating I Schedule development I Schedule control Project cost management 0 Ensures that a project is completed within the resource constraints 0 Some projects are planned using only a financial budget I From which all resources must be procured 0 Includes resource planning cost estimating cost budgeting and cost control Project quality management 0 Ensures project meets project specifications 0 Quality objective met I When deliverables meet requirements specified in project plan 0 A good plan defines project deliverables in unambiguous terms I For easy comparison against actual results 0 Includes quality planning quality assurance and quality control Project human resource management 0 Ensures personnel assigned to project are effectively employed 0 Staffing a project requires careful estimates of effort required 0 Unique complexities I Extended clearances I Deploying technology new to the organization 0 Includes organizational planning staff acquisition and team development Project communications management 0 Conveys details of project activities to all involved 0 Includes the creation distribution classification storage and destruction of documents messages and other associated project information 0 Includes communications planning information distribution performance reporting and administrative closure 0 Project risk management 0 Assesses mitigates manages and reduces the impact of adverse occurrences on the project 0 Includes risk identification risk quantification risk response development and risk response control 0 Project procurement 0 Acquiring needed project resources 0 Project managers may simply requisition resources from organization or may have to purchase 0 Includes procurement planning solicitation planning solicitation source selection contract administration and contract closeout Proiect M lgement Tools 0 Projectitis O Occurs when the project manager spends more time documenting project tasks collecting performance measurements recording project task information and updating project completion forecasts than accomplishing meaningful project work 0 Precursor to projectitis 0 Developing an overly elegant microscopically detailed plan before gaining consensus for the work required Work Brez down Structure 0 Work breakdown structure WBS 0 Simple planning tool for creating a project plan 0 The project plan is first broken down into a few major tasks I Each task is placed on the WBS task list 0 Determine minimum attributes for each task The work to be accomplished activities and deliverables Estimated amount of effort required for completion in hours or workdays The common or specialty skills needed to perform the task Task interdependencies Estimated capital and noncapital expenses for the task Task assignment according to specific skills Start and end dates Work to be accomplished Amount of effort Task dependencies 0 Start and ending dates 0 Work phase 0 000000000 0 Phase in which the project deliverables are prepared 0 Occurs after the project manager has completed the WBS TaskSequencing Approaches Network scheduling 0 Refers to the web of possible pathways to project completion Install Firewall Con gure Rules Test Operation Program Evaluation and Review Technique PERT 0 Most popular technique 0 Originally developed in the late 1950 s for govemmentdriven engineering projects gTHIS IS ON QUIZH Three key questions 0 How long will this activity take 0 What activity occurs immediately before this activity can take place 0 What activity occurs immediately after this activity Determine the critical path 0 By identifying the slowest path through the various activities Slack time 0 How much time is available for starting a noncritical task without delaying the project as a whole 0 Tasks which have slack time are logical candidates for accepting a delay PERT advantages 0 Makes planning large projects easier I By facilitating the identification of pre and post activities 0 Determines the probability of meeting requirements 0 Anticipates the impact of system changes 0 Presents information in a straightforward format understood by managers I Requires no formal training PERT disadvantages O Diagrams can be awkward and cumbersome especially in very large projects 0 Diagrams can become expensive to develop and maintain I Due to the complexities of some project development processes 0 Difficulty in estimating task durations I Inaccurate estimates invalidate any close critical path calculations Gantt chart 0 Easy to read and understand easy to present to management 0 Easier to design and implement than the PERT diagrams yielding much of the same information 0 Vertical axis of a bar chart and provides a simple time line on the horizontal axis Automated Proiect Tools 0 Microsoft Project 0 A widely used project management tool 0 Keep in mind 0 A software program is no substitute for a skilled and experienced project manager I Manager must understand how to define tasks allocate scarce resources and manage assigned resources 0 A software tool can get in the way of the work 0 Choose a tool that you can use effectively
Are you sure you want to buy this material for
You're already Subscribed!
Looks like you've already subscribed to StudySoup, you won't need to purchase another subscription to get this material. To access this material simply click 'View Full Document'