ITC 203

Information Systems Security

Fundamentals
Learning Outcomes
• At the end of the course, the student should be
able to
• Understand Information Security (InfoSec)
principles and approaches
• Understand the basic components of InfoSec
• Understand basic InfoSec applications
• Have the ability to remain current with InfoSec
literature
Lecturer’s Name: Robert Bazuku
 Course Outline
• Module 1: Introduction to Information Security
• Module 2: Risk, Threats and Vulnerabilities
• Module 3: Cryptography
• Module 4: Network Security
• Module 5: Identity and Access Management
(IAM)
• Module 6: Cloud Security
• Module 7: Incident Response, Disaster Recovery
and Cyberspace Law
• Module 8: Emerging Security Trends
 SECURITY
• Security is a state of being secure and free from
danger or harm. Also, it can be defined as the
actions taken to make someone or something
secure
• Security is protection, protection from
adversaries; those who would do harm,
intentionally or otherwise is the ultimate
objective of security.
• National security, for example, is a multilayered
system that protects the sovereignty of a state, its
assets, its resources, and its people.
 SECURITY
• Achieving the appropriate level of security for
an organization also requires a multifaceted or
multilayered system.
• A successful organization should have multiple
layers of security in place to protect its
operations, physical infrastructure, people,
functions, communications, and information.
 INFORMATION SECURITY
• Information security deals with the
protection of the confidentiality, integrity,
and availability of information assets,
whether in storage, processing, or
transmission, via the application of policy,
education, training and awareness, and
technology.
 INFO. SECURITY CONTINUED
• The Committee on National Security Systems
(CNSS) defines information security as the
protection of information and its critical
elements, including the systems and hardware
that use, store, and transmit the information.
• Information security includes the broad areas
of information security management, data
security, and network security
 INFO. SECURITY CONTINUED
• C.I.A. is the industry standard for computer
security since the development of the
mainframe.
• The standard is based on three characteristics
that describe the utility of information:
confidentiality, integrity, and availability
 INFO. SECURITY CONTINUED
• Communications security is the protection of
all communications media, technology, and
content.
• Network security is a subset of
communications security and this deal with
the protection of voice and data networking
components, connections, and content.
.
 INFO. SECURITY CONTINUED
• The security of these three characteristics is as
important today as it has always been, but the
C.I.A. triad model is generally viewed as no longer
adequate in addressing the constantly changing
environment.
• The threats to the confidentiality, integrity, and
availability of information have evolved into a
vast collection of events, including accidental or
intentional damage, destruction, theft,
unintended or unauthorized modification, or
other misuse from human or nonhuman threats.
 INFO. SECURITY CONTINUED
• This vast array of constantly evolving threats
has prompted the development of a more
robust model that addresses the complexities
of the current information security
environment.
 Types of Info. Security

• Network security
This type of security encompasses the protection of
computer networks against unauthorized access or
misuse.
Network security involves a range of technologies,
such as firewalls, intrusion detection/prevention
systems, virtual private networks (VPNs), and
secure protocols, to ensure data confidentiality,
integrity, and availability
 Types of Info. Security Continued
• Application security
Application security involves securing software
applications from cyber threats, such as
malware, SQL injection attacks, and cross-site
scripting (XSS).
Application security solutions include secure
coding practices, penetration testing, and
vulnerability assessments.
 Types of Info. Security Continued
• Data security
Data security is the practice of protecting
sensitive data from unauthorized access, use,
disclosure, or destruction.
Data security involves a range of technologies,
such as encryption, access control, and backup
and restore procedures, to ensure data
confidentiality, integrity, and availability.
 Types of Info. Security Continued
• Endpoint security
• Endpoint security focuses on protecting
endpoints, such as laptops, desktops, servers, and
mobile devices, from cyber threats.
• Traditional endpoint security technologies include
antivirus and anti-malware software and
firewalls. Modern endpoint security includes
advanced solutions like endpoint detection and
response (EDR) that can protect against zero-day
threats.
 Types of Info. Security Continued
• Mobile security
Mobile security refers to the protection of
mobile devices, applications, and data from
unauthorized access or exploitation.
Mobile security solutions include mobile device
management (MDM) software, secure mobile
application development, and secure
communication protocols.
 Types of Info. Security Continued
• Cloud security
Cloud security involves the protection of cloud-
based data, applications, and infrastructure. It
covers a variety of security concerns, including
data privacy, access control, threat
management, and compliance.
 Types of Info. Security Continued
• IoT security
IoT security involves securing the networks,
devices, and data associated with the Internet of
Things (IoT). IoT security covers a range of
security issues, including data privacy, access
control, device authentication, and network
security
 Key concepts in info. security

Access:
• A subject or object’s ability to use,
manipulate, modify, or affect another subject
or object.
• Authorized users have legal access to a
system, whereas hackers must gain illegal
access to a system. Access controls regulate
this ability
 Key concepts in info. Security
Continued
Asset:
• The organizational resource that is being
protected.
• An asset can be logical, such as a Web site,
software information, or data; or an asset can be
physical, such as a person, computer system,
hardware, or other tangible object.
• Assets, particularly information assets, are the
focus of what security efforts are attempting to
protect
 Key concepts in info. Security
Continued
Attack:
• An intentional or unintentional act that can
damage or otherwise compromise information
and the systems that support it.
• Attacks can be active or passive, intentional or
unintentional, and direct or indirect.
 Key concepts in info. Security
Continued
• Attacks can be active or passive, intentional or
unintentional, and direct or indirect.
• In an active attack, the attacker will directly interfere
with the target to damage or gain unauthorized access
to computer systems and networks.
• A passive attack is a network attack in which a system
is monitored and sometimes scanned for open ports
and vulnerabilities.
• A hacker attempting to break into an information
system is an intentional attack. A lightning strike that
causes a building fire is an unintentional attack.
 Key concepts in info. Security
Continued
• A direct attack is perpetrated by a hacker using a
PC to break into a system.
• An indirect attack is a hacker compromising a
system and using it to attack other systems—for
example, as part of a botnet (robot network).
• This group of compromised computers, running
software of the attacker’s choosing, can operate
autonomously or under the attacker’s direct
control to attack systems and steal user
information or conduct distributed denial-of-
service attacks.
 Key concepts in info. Security
Continued
• Direct attacks originate from the threat itself.
Indirect attacks originate from a compromised
system or resource that is malfunctioning or
working under the control of a threat
Control, safeguard, or countermeasure:
Security mechanisms, policies, or procedures
that can successfully counter attacks, reduce
risk, resolve vulnerabilities, and otherwise
improve security within an organization.
 Key concepts in info. Security
Continued
Exploit: (Take Advantage)
• A technique used to compromise a system.
Threat agents may attempt to exploit a system or
other information asset by using it illegally for
their personal gain. Or, an exploit can be a
documented process to take advantage of a
vulnerability or exposure, usually in software,
which is either inherent in the software or
created by the attacker. Exploits make use of
existing software tools or custom-made software
components.
 Key concepts in info. Security
Continued
Exposure:
• A condition or state of being exposed; in
information security, exposure exists when
vulnerability is known to an attacker
Loss:
• A single instance of an information asset suffering
damage or destruction, unintended or
unauthorized modification or disclosure, or
denial of use. When an organization’s information
is stolen, it has suffered a loss.
 Key concepts in info. Security
Continued
• Protection profile or security posture: The entire
set of controls and safeguards, including policy,
education, training and awareness, and
technology, that the organization implements to
protect the asset.
• Risk: The probability of an unwanted occurrence,
such as an adverse event or loss. Organizations
must minimize risk to match their risk appetite—
the quantity and nature of risk they are willing to
accept
 Key concepts in info. Security
Continued
• Subjects and objects of attack: A computer
can be either the subject of an attack, an
agent entity used to conduct the attack or the
object of an attack
A computer can also be both the subject and
object of an attack. For example, it can be
compromised by an attack (object) and then
used to attack other systems (subject).
 Key concepts in info. Security
Continued
• Threat: Any event or circumstance that has
the potential to adversely affect operations
and assets.
• Threat event: An occurrence of an event
caused by a threat agent. An example of a
threat event might be damage caused by a
storm
 Key concepts in info. Security
Continued
• Threat agent: The specific instance or a
component of a threat. For example, the threat
source of “trespass or espionage” is a category of
potential danger to information assets, while
“external professional hacker” (like Kevin Mitnick,
who was convicted of hacking into phone
systems) is a specific threat agent. A lightning
strike, hailstorm, or tornado is a threat agent that
is part of the threat source known as “acts of
God/acts of nature.”
 Key concepts in info. Security
Continued
• Threat event: An occurrence of an event
caused by a threat agent. An example of a
threat event might be damage caused by a
storm.
 Key concepts in info. Security
Continued
• Threat source: A category of objects, people, or
other entities that represents the origin of danger
to an asset—in other words, a category of threat
agents. Threat sources are always present and
can be purposeful or undirected. For example,
threat agent “hackers,” as part of the threat
source “acts of trespass or espionage,” purposely
threaten unprotected information systems, while
threat agent “severe storms,” as part of the
threat source “acts of God/acts of nature,”
incidentally threaten buildings and their contents.
 Key concepts in info. Security
Continued
• Vulnerability: A potential weakness in an
asset or its defensive control system(s). Some
examples of vulnerabilities are a flaw in a
software package, an unprotected system
port, and an unlocked door. Some well-known
vulnerability have been examined,
documented, and published; others remain
latent (or undiscovered).
Critical Characteristics of Information
• The value of information comes from the
characteristics it possesses. When a
characteristic of information changes, the
value of that information either increases or,
more commonly, decreases.
 Critical Characteristics of Info.
• Accuracy: An attribute of information that describes
how data is free of errors and has the value that the
user expects.
• Authenticity: An attribute of information that
describes how data is genuine or original rather than
reproduced or fabricated.
• Availability: An attribute of information that describes
how data is accessible and correctly formatted for use
without interference or obstruction.
• Confidentiality: An attribute of information that
describes how data is protected from disclosure or
exposure to unauthorized individuals or systems.
 Critical Characteristics of Info.
• Integrity: An attribute of information that describes
how data is whole, complete, and uncorrupted.
• Personally identifiable information (PII): A set of
information that could uniquely identify an individual.
• Possession: An attribute of information that describes
how the data’s ownership or control is legitimate or
authorized.
• Utility: An attribute of information that describes how
data has value or usefulness for an end purpose.
Components of an Information
System
Hardware

Data Software

Procedures Networks

People
Approaches to Information Security
Implementation
 Information Security Policy,
Standards, and Practices
• An information security policy (ISP) is a set of
rules, policies and procedures designed to
ensure all end users and networks within an
organization meet minimum IT security and
data protection security requirements.
• Policies direct how issues should be addressed
and how technologies should be used
 Information Security Policy,
Standards, and Practices
• Policies do not specify the proper operation of
equipment or software, this information
should be placed in the standards,
procedures, and practices of users’ manuals
and systems documentation
Information Security Policy Continued

• Good security programs begin and end with

policy
• Information security is primarily a
management problem, not a technical one,
and policy is a management tool that obliges
personnel to function in a manner that
preserves the security of information assets
 Information Security Practices
• Actions that illustrate compliance with policies
• If the policy states to “use strong passwords,
frequently changed,” the practices might
advise that “according to X, most
organizations require employees to change
passwords at least every 3 months.”
 Information Security Procedures
• Step-by-step instructions designed to assist
employees in following policies, standards,
and guidelines
• If the policy states to “use strong passwords,
frequently changed,” the procedure might
advise that “in order to change your
password, first click the Windows Start button,
then….”
 Information Security Standard
• A detailed statement of what must be done to
comply with policy, sometimes viewed as the
rules governing policy compliance.
• If the policy states that employees must “use
strong passwords, frequently changed,” the
standard might specify that the password
“must be at least 8 characters, with at least
one number, one letter, and one special
character.”
 National Institute of Standards and
Technology (NIST):
• Management must define three types of
security policy, according to NIST:
1. Enterprise information security policies
(general security policy, organizational security
policy, IT security policy)
2. Issue-specific security policies
3. Systems-specific security policies
 Enterprise information security
policies
• Eexecutive-level document, usually drafted by
or in cooperation with the organization’s chief
information office
• Usually 2 to 10 pages long and shapes the
philosophy of security in the IT environment
• It sets out the requirements that must be met
by the information security blueprint or
framework
 Enterprise information security
policies Continued
• It defines the purpose, scope, constraints, and
applicability of the security program.
• It also assigns responsibilities for the various
areas of security, including systems
administration, maintenance of the
information security policies, and the
practices and responsibilities of users
• Finally, it addresses legal compliance,
 Enterprise information security
policies Continued
According to NIST, the EISP typically addresses
compliance in two areas:
• 1. General compliance to ensure that an
organization meets the requirements for
establishing a program and assigning
responsibilities therein to various
organizational components
• 2. The use of specified penalties and
disciplinary action.
 Elements of EISP

1. An overview of the corporate philosophy

(viewpoint) on security
2. Information on the structure of the information
security organization and people who fulfill the
information security role
3. Fully articulated responsibilities for security that
are shared by all members of the organization
(employees, contractors, consultants, partners,
and visitors)
4. Fully articulated responsibilities for security that
are unique to each role within the organization
Issue-Specific Security Policy (ISSP)
• Provides detailed, targeted guidance to
instruct all members of the organization in the
use of a resource, such as one of its processes
or technologies.
• It instruct employees on their proper use of a
resource.
 Issue-Specific Security Policy (ISSP)
Continued
In general, the issue-specific security policy, or
ISSP,
1. Addresses specific areas of technology e,g
email services
2. Requires frequent updates, and
3. Contains a statement about the
organization’s position on a specific issue.
 Issue-Specific Security Policy (ISSP)
Continued
ISSP may cover the following topics, among others:
1. E-mail
2. Use of the Internet and World Wide Web
3. Specific minimum configurations of computers to
defend against worms and viruses
4. Prohibitions against hacking or testing organization
security controls
5. Home use of company-owned computer equipment
6. Use of personal equipment on company networks
(BYOD: bring your own device)
 Issue-Specific Security Policy (ISSP)
Continued
ISSP may cover the following topics, among others:
7. Use of telecommunications technologies, such as fax
and phone
8. Use of photocopy equipment
9. Use of portable storage devices such as USB memory
sticks, backpack drives, game players, music players, and
any other device capable of storing digital files
10. Use of cloud-based storage services that are not self-
hosted by the organization or engaged under contract;
such services include Google Drive, Dropbox, and
Microsoft Live
 Systems-Specific Security Policy
(SysSP)
SysSPs often function as standards or procedures to
be used when configuring or maintaining systems.
For example, a SysSP might describe the
configuration and operation of a network firewall.
This document could include a statement of
managerial intent; guidance to network engineers
on the selection, configuration, and operation of
firewalls; and an access control list that defines
levels of access for each authorized user.
 Systems-Specific Security Policy
(SysSP) continued

Read on;
1. Managerial guidance SysSPs
2. Technical specifications SysSPs
3. Access control List (ACL)
 Purpose of an Information Security
Policy
1. Establish a general approach to information
security
2. Document security measures and user access
control policies
3. Detect and minimize the impact of
compromised information assets such as misuse
of data, networks, mobile devices, computers
and applications
4. Protect the reputation of the organization
5. Comply with legal and regulatory requirements
like NIST, GDPR, HIPAA and FERPA
 Purpose of an Information Security
Policy Continued
6. Protect their customer's data, such as credit
card numbers
7. Provide effective mechanisms to respond to
complaints and queries related to real or
perceived cyber security risks such
as phishing, malware and ransomware
8. Limit access to key information technology
assets to those who have an acceptable use
 Information Security Policy
Components
1. Purpose: policy's objectives and Organ.
commitment
2. Scope: describe systems, data, and personnel
covered by the policy, including any third-party
vendors or partners
3. Roles and responsibilities: stakeholders roles
4. Asset management: identifying, classifying, and
manage
5. Access control: Rules for granting and revoking
access to systems and data
 Information Security Policy
Components
• Incident response: Detecting, reporting, and responding to security
incidents

• Policy review and updates: ensure it remains relevant, effective,

and aligned with the organization's evolving needs

• Monitoring and auditing: compliance with the policy, including

regular audits, assessments, and reviews to identify gaps and areas
for improvement.
• Training and awareness: promote a culture of security and ensure
that personnel understand their responsibilities.

• Physical security:protect the organization's facilities, equipment,

and information assets
 Assignment
• Develop an Information Security Policy
document for UTAS.
• Maximum number of 10 pages
• Date of submision: 4thth march. 2026
 MODULE 2
THREATS, VULNERABILITIES AND RISK