Chapter 1

INTRODUCTION TO THE MANAGEMENT OF

INFORMATION SECURITY

1) Introduction to Security
 As businesses have become more fluid, "computer security" has evolved into "information security,"
or "InfoSec," which covers a broader range of issues, from the protection of computer-based data to
the protection of human knowledge.
 Asset is an organizational resource that is being protected. An asset can be logical, such as a Web
site, software information, or data; or an asset can be physical, such as a person, computer system,
hardware, or other tangible object.
 Assets, particularly information assets, are the focus of what security efforts are attempting to
protect.
 Information asset is the focus of information security; information that has value to the organization,
and the systems that store, process, and transmit the information.
 Information security is no longer the sole responsibility of a small, dedicated group of professionals in
the company. It is now the responsibility of all employees, especially managers.
 Information Security (InfoSec) is protection of the confidentiality, integrity, and availability of
information assets, whether in storage, processing, or transmission, via the application of policy,
education, training and awareness, and technology.
 The entire organization is represented by three distinct groups of managers and professionals, or
communities of interest:
a) Those in the field of information security
b) Those in the field of IT
c) Those from the rest of the organization

 These three groups should engage in a constructive effort to reach consensus on an overall plan to
protect the organization's information assets.
 The communities of interest and the roles they fulfill include the following:
a) The information security community protects the organization's information assets from
the many threats they face.
b) The IT community supports the business objectives of the organization by supplying and
supporting IT that is appropriate to the organization's needs.
c) The general business community articulates and communicates organizational policy and
objectives and allocates resources to the other groups.

 Each community of interest must understand that information security is about identifying,
measuring, and mitigating (or at least understanding and documenting) the risk associated with
operating information assets in a modern business environment.
 Security means being free from danger. To be secure is to be protected from the risk of loss, damage,
unwanted modification, or other hazards.

Chapter 1 |Introduction to the management of security 1

- Neha Rathi
 Security is often achieved by means of several strategies undertaken simultaneously or used in
combination with one another.
 It is the role of management to ensure that each strategy is properly planned, organized, staffed,
directed, and controlled.
 Specialized areas of security include:
a) Physical security- The protection of physical items, objects, or areas from unauthorized
access and misuse.
b) Operations security- The protection of the details of an organization's operations and
activities.
c) Communications security- The protection of all communications media, technology, and
content.
d) Cyber (or computer) security- The protection of computerized information processing
systems and the data they contain and process. The term cybersecurity is relatively new, so
its use might be slightly ambiguous in coming years as the definition gets sorted out.
e) Network security- A subset of communications security and cybersecurity; the protection of
voice and data networking components, connections, and content.

 Information security (lnfoSec) focuses on the protection of information and the characteristics that
give it value, such as confidentiality, integrity, and availability, and includes the technology that
houses and transfers that information through a variety of protection mechanisms such as policy,
training and awareness programs, and technology.
 Figure 1- 1 show that InfoSec includes the broad areas of InfoSec management: computer security,
data security, and network security. The figure also shows that policy is the space where these
components overlap.

2) CNSS Security Model

 The CNSS document NSTISSI No. 4011, "National Training Standard for Information Systems
Security (InfoSec) Professionals;' presents a comprehensive model of InfoSec known as the
McCumber Cube, which is named after its developer, John McCumber.
Chapter 1 |Introduction to the management of security 2
- Neha Rathi
 Figure 1- 2 shows the McCumber Cube which serves as the standard for understanding many aspects
of InfoSec, and shows the three dimensions of InfoSec: information characteristics, information
location, and security control categories.
 If the relationship among the three dimensions that are represented by the axes in the figure is
extended then a 3 x 3 x 3 cube with 27 cells is formed.
 Each cell represents an area of intersection among these three dimensions, which must be addressed to
secure information.

 When using this model to design or review any InfoSec program, it is made sure that each of the 27
cells is properly addressed by each of the three communities of interest.
 For example, the cell representing the intersection of the technology, integrity, and storage criteria
could include controls or safeguards addressing the use of technology to protect the integrity of
information while in storage.
 Such a control might consist of a host intrusion detection and prevention system (HIDPS), for
example, which would alert the security administrators when a critical file was modified or deleted.
 Advantage:
The model identifies gaps in the coverage of an InfoSec program.
 Disadvantage:
1) Model omits any discussion of guidelines and policies that direct the implementation of
controls, which are essential to an effective InfoSec program.
2) These controls can be implemented only through a process that includes consensus building
and constructive conflict to reflect the balancing act that each organization faces as it
designs and executes an InfoSec program.

3) The Value of Information and the C.I.A. Triad

 The C.I.A. triad has been expanded into a more comprehensive list of critical characteristics and
processes. These characteristics are explained in more detail in the sections that follow.

Chapter 1 |Introduction to the management of security 3

- Neha Rathi
 1) Confidentiality
 Confidentiality means limiting access to information only to those who need it, and preventing access
by those who do not.
 When unauthorized individuals or systems can view information, confidentiality is breached. To
protect the confidentiality of information, a number of measures are used, including:
• Information classification
• Secure document (and data) storage
• Application of general security policies
• Education of information custodians and end users
• Cryptography (encryption)
 In an organization, confidentiality of information is especially important for personal information
about employees, customers, or patients. People expect organizations to closely guard such
information.
 Whether the organization is a government agency, a commercial enterprise, or a nonprofit charity,
problems arise when organizations disclose confidential information.
 Disclosure can occur either deliberately or by mistake.
 For example, confidential information could be mistakenly e-mailed to someone outside the
organization rather than the intended person inside the organization. Or perhaps an employee discards,
rather than destroys, a document containing critical information. Or maybe a hacker successfully
breaks into a Web-based organization's internal database and steals sensitive information about clients,
such as names, addresses, or credit card information.

2) Integrity
 The integrity or completeness of information is threatened when it is exposed to corruption, damage,
destruction, or other disruption of its authentic state.
 Corruption can occur while information is being entered, stored, or transmitted.
 Many computer viruses and worms, for example, are designed to corrupt data. For this reason, the key
method for detecting whether a virus or worm has caused an integrity failure to a file system is to look
for changes in the file's state, as indicated by the file's size or, in a more advanced operating system, its
hash value or checksum
 File corruption is not always the result of deliberate attacks.
 Faulty programming or even noise in the transmission channel or medium can cause data to lose its
integrity. For example, a low-voltage states in a signal carrying a digital bit (a 1 or o) can cause the
receiving system to record the data incorrectly.
 To compensate for internal and external threats to the integrity of information, systems employ a
variety of error-control techniques, including the use of redundancy bits and check bits. During each
transmission, algorithms, hash values, and error-correcting codes ensure the integrity of the
information.
 Data that has not been verified in this manner is retransmitted or otherwise recovered. Because
information is of little or no value or use if its integrity cannot be verified, information integrity is a
cornerstone of InfoSec.

3) Availability
 Availability of information means that users, either people or other systems, have access to it in a
usable format.

Chapter 1 |Introduction to the management of security 4

- Neha Rathi
 Availability does not imply that the information is accessible to any user; rather, it means it can be
accessed when needed by authorized users.
 For example, consider the contents of a library- in particular, research libraries that require
identification for access to the library as a whole or to certain collections. Library patrons must present
the required identification before accessing the collection. Once they are granted access, patrons
expect to be able to locate and access resources in the appropriate languages and formats.

4) Privacy
 Information that is collected, used, and stored by an organization should be used only for the purposes
stated by the data owner at the time it was collected.
 Privacy does not mean freedom from observation (the meaning usually associated with the word); it
means that the information will be used only in ways approved by the person who provided it.
 Many organizations collect, swap, and sell personal information as a commodity.
 Today, it is possible to collect and combine personal information from several different sources
{known as information aggregation), which has resulted in databases that could be used in ways the
original data owner has not agreed to or even knows about.
 Many people have become aware of these practices and are looking to the government to protect their
information's privacy.

5) Identification
 Identification process recognizes individual users.
 Identification is the first step in gaining access to secured material, and it serves as the foundation for
subsequent authentication and authorization.
 Identification and authentication are essential to establishing the level of access or authorization that an
individual is granted.
 Identification is typically performed by means of a user name or other ID.

6) Authentication
 Authentication is the process by which a control establishes whether a user (or system) is the entity it
claims to be.
 Examples include the use of cryptographic certificates to establish Secure Sockets Layer (SSL)
connections as well as the use of cryptographic hardware devices- for example, hardware tokens such
as RSA's SecurID.
 Individual users may disclose a personal identification number (PIN), a password, or a passphrase to
authenticate their identities to a computer system.

7) Authorization
 After the identity of a user is authenticated, a process called authorization defines what the user
(whether a person or a computer) has been specifically and explicitly authorized by the proper
authority to do, such as access, modify, or delete the contents of an information asset.
 An example of authorization is the activation and use of access control lists and authorization groups
in a networking environment.
 Another example is a database authorization scheme to verify that the user of an application is
authorized for specific functions, such as reading, writing, creating, and deleting.

Chapter 1 |Introduction to the management of security 5

- Neha Rathi
 8) Accountability
 Accountability of information occurs when a control provides assurance that every activity undertaken
can be attributed to a named person or automated process.
 For example, audit logs that track user activity on an information system provide accountability.

4) Threats & Attacks

 A threat represents a potential risk to an information asset, whereas an attack, sometimes called a
threat event, represents an ongoing act against the asset that could result in a loss.
 Threat agents damage or steal an organization's information or physical assets by using exploits to
take advantage of vulnerability where controls are not present or no longer effective.
 Unlike threats, which are always present, attacks exist only when a specific act may cause a loss.
 For example, the threat of damage from a thunderstorm is present throughout the summer in many
places, but an attack and its associated risk of loss exist only for the duration of an actual
thunderstorm.

1) Compromises to Intellectual Property

 Intellectual property can be trade secrets, copyrights, trademarks, and patents.
 IP is protected by copyright and other Jaws, carries the expectation of proper attribution or
credit to its source, and potentially requires the acquisition of permission for its use, as
specified in those laws.

Chapter 1 |Introduction to the management of security 6

- Neha Rathi
 a) Software piracy
 Organizations often purchase or lease the IP of other organizations, and must abide by a
purchase or licensing agreement for its fair and responsible use.
 The most common IP breach is the unlawful use or duplication of software-based intellectual
property, more commonly known as software piracy.
 Many individuals and organizations do not purchase software as mandated by the owner's
license agreements. Because most software is licensed to a particular purchaser, its use is
restricted to a single user or to a designated user in an organization.
 If the user copies the program to another computer without securing another license or
transferring the license, the user has violated the copyright. Software licenses are strictly
enforced by regulatory and private organizations, and software publishers use several control
mechanisms to prevent copyright infringement.

b) Copyright protection and user registration

 A number of technical mechanismsdigital watermarks, embedded code, copyright or
activation codes, and even the intentional placement of bad sectors on software media- have
been used to enforce copyright laws.
 The most common tool is a unique software registration code in combination with an end-
user license agreement (EULA) that usually pops up during the installation of new software,
requiring users to indicate that they have read and agree to conditions of the software's use.

2) Deviations in quality of service

 An organization's information system depends on the successful operation of many
interdependent support systems, including power grids, data and telecommunications networks,
parts suppliers, service vendors, and even janitorial staff and garbage haulers.
 Any of these support systems can be interrupted by severe weather, employee illnesses, or other
unforeseen events. This degradation of service is a form of availability disruption.

a) Internet service issues

 In organizations that rely heavily on the Internet and the Web to support continued operations,
ISP failures can considerably undermine the availability of information.
 Many organizations have sales staff and telecommuters working at remote locations. When
these offsite employees cannot contact the host systems, they must use manual procedures to
continue operations.
 When an organization places its Web servers in the care of a Web hosting provider, that
provider assumes responsibility for all Internet services and for the hardware and operating
system software used to operate the Web site.
 These Web hosting services are usually arranged with a service level agreement (SLA). When a
service provider fails to meet the terms of the SLA, the provider may accrue fines to cover
losses incurred by the client, but these payments seldom cover the losses generated by the
outage.

b) Communications & other service provider issues

 Other utility services like telephone, water, wastewater, trash pickup, cable television, natural
or propane gas, and custodial services can affect organizations as well.

Chapter 1 |Introduction to the management of security 7

- Neha Rathi
  The loss of these services can impair the ability of an organization to function. For instance,
most facilities require water service to operate an air- conditioning system. If a wastewater
system fails, an organization might be prevented from allowing employees into the building.
 While several online utilities allow an organization to compare pricing options from various
service providers, only a few show a comparative analysis of availability or downtime.

c) Power irregularities
 Irregularities from power utilities are common and can lead to fluctuations such as power
excesses, power shortages, and power losses.
 These fluctuations can pose problems for organizations that provide inadequately conditioned
power for their information systems equipment.
 In the United States, residential users are supplied 120-volt, Go-cycle power, usually through
15- and 20-amp circuits. Commercial buildings often have 240-volt service and may also have
specialized power distribution infrastructure.
 When power voltage levels vary from normal, expected levels, such as during a blackout,
brownout, fault, noise, spike, surge, or sag, an organization's sensitive electronic equipment-
especially networking equipment, computers, and computer-based systems, which are
vulnerable to fluctuations- can be easily damaged or destroyed.
 Most good uninterruptible power supplies (UPS) can protect against spikes, surges, and sags,
and even brownouts and blackouts of limited duration.

3) Espionage or Trespass
 When an unauthorized person gains access to information an organization is trying to protect,
the act is categorized as espionage or trespass.
 Some information-gathering techniques are legal- for example, using a Web browser to perform
market research. These legal techniques are collectively called competitive intelligence.
 When information gatherers employ techniques that cross a legal or ethical threshold, they are
conducting industrial espionage.
a) Shoulder surfing
 It is used in public or semipublic settings when people gather information they are not
authorized to have.
 Instances of shoulder surfing occur at computer terminals, desks, and ATMs; on a bus, airplane,
or subway, where people use smart-phones and tablet PCs; and in other places where
employees may access confidential information.
 Shoulder surfing flies in the face of the unwritten etiquette among professionals who address
information security in the workplace: If you can see person entering personal or private
information into a system, look away as the information is entered. Failure to do so constitutes
not only a breach of etiquette, but also an affront to privacy and a threat to the security of
confidential information.

b) Hackers
 The classic perpetrator of espionage or trespass is the hacker, who is frequently glamorized in
fictional accounts as a person who stealthily manipulates a maze of computer networks,
systems, and data to find information that solves the mystery and heroically saves the day.
 In the real world, a hacker frequently spends long hours examining the types and structures of

Chapter 1 |Introduction to the management of security 8

- Neha Rathi
 targeted systems and uses skill, guile, and/or fraud to attempt to bypass controls placed on
information owned by someone else.

i) Expert hacker
 The expert hacker is usually a master of several programming languages, networking
protocols, and operating systems, and exhibits a mastery of the technical environment of the
chosen targeted system.
 Once an expert hacker chooses a target system, the likelihood is high that he or she will
successfully enter the system.

a) Professional hacker
 The professional hacker seeks to conduct attacks for personal benefit or the benefit of
an employer, which is typically a crime organization or governmentsponsored
operation (see the section on cyber-terrorism).

b) Penetration tester
 The penetration tester is one who has authorization from an organization to test its
information systems and network defense, and is expected to provide detailed reports
of the findings.

 The primary differences between professional hackers and penetration testers are the
authorization provided and the ethical professionalism displayed.
 The precisely targeted attack against organizations is known as an advanced persistent threat
or APT. These attacks are usually a combination of social engineering, spear phishing, and
customized malware generated by nation-state sponsored organizations or sophisticated
criminal operations.
 In many cases, these attacks seek to infiltrate high-value information for economic espionage or
attacks against national security.

ii) Novice hacker

 Novice hackers have little or no real expertise of their own, but rely upon the expertise of
expert hackers, who often become dissatisfied with attacking systems directly and turn their
attention to writing software.
 These programs are automated exploits that allow novice hackers to act as script kiddies or
packet monkeys.
 Script kiddie is a hacker of limited skill who uses expertly written software to attack a
system. Also known as skids, skiddies, or script bunnies.
 Packet monkey is a script kiddie who uses automated exploits to engage in denial-of-service
attacks.

(_ _ _ cont. hackers_ _ _)
 Once an attacker gains access to a system, attacker increase his or her privileges (privilege

Chapter 1 |Introduction to the management of security 9

- Neha Rathi
 escalation). While most accounts associated with a system have only rudimentary "use"
permissions and capabilities, the attacker needs administrative or "root" privileges.
 These privileges allow attackers to access information; modify the system itself to view all
information in it, and hide their activities by modifying system logs.
 A common example of privilege escalation is called jailbreaking or rooting.
 Owners of certain smartphones can download and use particular tools to gain control over
system functions, often against the original intentions of the designers. The term jailbreaking is
more commonly associated with Apple's iOS devices, while the term rooting is more common
with Android-based devices.
 The term cracker is commonly associated with software copyright bypassing and password
decryption. With the removal of the copyright protection, software can be easily distributed and
installed.
 With the decryption of user passwords from stolen system files, user accounts can be illegally
accessed.

c) Phreakers
 Phreakers grew in fame in the 1970s when they developed following devices.
i) Blue boxes
 Blue boxes enabled Phreakers to make free calls from pay phones.
ii) Red boxes
 Red boxes were developed to simulate the tones of coins falling in a pay phone.
iii) Black boxes
 Black boxes emulated the line voltage.

d) Password attacks
 Password attacks fall under the category of espionage or trespass just as lock-picking falls
under breaking and entering. Attempting to guess or reverse-calculate a password is often
called cracking.

i) Brute force
 The application of computing and network resources to try every possible password
combination is called a brute force password attack.
 If attackers can narrow the field of target accounts, they can devote more time and resources
to these accounts.
 This is one reason to always change the default administrator password assigned by the
manufacturer.
 Brute force password attacks are rarely successful against systems that have adopted the
manufacturer's recommended security practices.
 Controls that limit the number of unsuccessful access attempts within a certain time are very
effective against brute force attacks.
 The strength of a password is a combination of its length and complexity, which help
determine its ability to withstand a brute force attack.
 Using best-practice policies for passwords can greatly enhance their strength; use passwords
of at least 10 characters and at least one uppercase and lowercase letter, one number and one
special character, and systems that allow case-sensitive passwords.

Chapter 1 |Introduction to the management of security 10

- Neha Rathi
 ii) Dictionary attack
 The dictionary password attack, or simply dictionary attack, is a variation of the brute force
attack that narrows the field using a dictionary of common passwords and includes
information related to the target user, such as names of relatives or pets, and familiar
numbers such as phone numbers, addresses, and even Social Security numbers.
 Organizations can use similar dictionaries to disallow passwords during the reset process
and thus guard against passwords that are easy to guess.
 In addition, rules requiring numbers and special characters in passwords make the dictionary
attack less effective.

iii) Rainbow tables

 A faster password attack is possible if the attacker can gain access to an encrypted password
file, such as the Security Account Manager (SAM) data file.
 While these password files contain hashed representations of users' passwords- not the actual
passwords, and thus cannot be used by themselves- the hash values for a wide variety of
passwords can be stored in a database known as a rainbow table.
 These files can be quickly searched, and the hash value and its corresponding plaintext value
can be easily located.

iv) Social engineering password attacks

 Using an approach commonly referred to as pretexting, attackers posing as an organization's
IT professionals may attempt to gain access to systems information by contacting low-level
employees and offering to help with their computer issues.
 By posing as a friendly and helpful helpdesk or repair technician, the attacker asks
employees for their usernames and passwords, and then uses the information to gain access
to organizational systems.
 Some will ask the user to install a back door or rootkit, allowing the attacker to directly
access the system.
 Some will even go so far as to actually resolve the user's issues. Social engineering password
attacks are much easier than hacking servers for password files.

4) Forces of nature
 Forces of nature, sometimes called acts of God, can present some of the most dangerous threats
because they usually occur with little warning and are beyond the control of people.
 Since it is not possible to avoid threats from forces of nature, organizations must implement
controls to limit damage and prepare contingency plans for continued operations, such as
disaster recovery plans, business continuity plans, and incident response plans.
 Another term that may encounter force majeure is roughly translated as "superior force”
which includes forces of nature as well as civil disorder and acts of war.

a) Fire
 The ignition of combustible material; damage can also be caused by smoke from fires or by
water from sprinkler systems or firefighters.
b) Flood

Chapter 1 |Introduction to the management of security 11

- Neha Rathi
  Water overflowing into an area that is normally dry, causing direct damage, and subsequent
indirect damage from high humidity and moisture.
c) Earthquake
 A sudden movement of the earth's crust caused by volcanic activity or the release of stress
accumulated along geologic faults.
d) Lightning
 An abrupt, discontinuous natural electric discharge in the atmosphere, which can cause
direct damage through an electrical surge or indirect damage from fires. Damage from
lightning can usually be prevented with specialized lightning rods and by installing special
electrical circuit protectors.
e) Landslide or mudslide
 The downward slide of a mass of earth and rock. Landslides or mudslides also disrupt
operations by interfering with access to buildings.
f) Tornados or severe windstorms
 Violent wind effects in which air moves at destructively high speeds, causing direct damage
and indirect damage from thrown debris. A tornado is a rotating column of whirling air that
can be more than a mile wide. Wind shear is a much smaller and linear wind effect, but it
can have similar devastating consequences.
g) Hurricanes, typhoons, tropical depressions
 Severe tropical storms that commonly originate at sea and move to land, bringing excessive
rainfall, flooding, and high winds.
h) Tsunami
 A very large ocean wave caused by an underwater earthquake or volcanic eruption; it can
reach miles inland as it crashes into land masses.
i) Electronic discharge
 Also known as static electricity, and usually little more than a nuisance. However, an
employee walking across a carpet on a cool, dry day can generate up to 12,000 volts of
electricity, and sensitive electronics can suffer damage from as little as 10 volts.
j) Dust contamination
 Can dramatically reduce the effectiveness of cooling mechanisms and potentially cause
components to overheat. Specialized optical technology, such as CD or DVD drives, can
suffer failures due to excessive dust contamination inside systems.

5) Human error or failure

 Inexperience, improper training, and incorrect assumptions are just a few things that can cause
human error or failure.
 Employee mistakes can easily lead to revelation of classified data, entry of erroneous data,
accidental deletion or modification of data, storage of data in unprotected areas, and failure to
protect information.
 Human error or failure often can be prevented with training, ongoing awareness activities, and
controls. These controls range from simple activities, such as requiring the user to type a critical
command twice, to more complex procedures, such as verifying commands by a second party.

a) Social engineering
 In the context of information security, social engineering is used by attackers to gain system

Chapter 1 |Introduction to the management of security 12

- Neha Rathi
 access or information that may lead to system access.
 There are several social engineering techniques, which usually involve a perpetrator posing
as a person who is higher in the organizational hierarchy than the victim.

b) Advance fee fraud

 Another social engineering attack called the advance-fee fraud (AFF), internationally
known as the 4-1-9 fraud, is named after a section of the Nigerian penal code.
 The perpetrators of 4-1-9 schemes often use the names of legitimate companies, such as the
Nigerian National Petroleum Company.
 Alternatively, they may invent other entities, such as a bank, government agency, long-lost
relative, lottery, or other nongovernmental organization.

c) Phishing
 Some attacks are sent by e-mail and may consist of a notice that one's e-mail storage
allotment has been exceeded.
 The user is asked to log in, to run a test program attached to the e-mail, or even to log into
their "bank" account (spoofed by the attacker) to verify their balance.
 While these attacks may seem crude to experienced users, the fact is that many e-mail users
have fallen for them. These tricks and similar variants are called phishing attacks.
 Phishing attacks use two primary techniques, often in combination with one another: URL
manipulation and Web site forgery.
 In URL manipulation, attackers send an HTML embedded e-mail message or a hyperlink
whose HTML code opens a forged Web site.
 In Web forgery, the attacker copies the HTML code from a legitimate Web site and then
modifies key elements.
 When victims type their banking ID and password, the attacker records that information and
displays a message that the Web site is now offline.

d) Spear phishing
 Spear phishing involves an attacker sending a targeted message that appears to be from an
employer, a colleague, or other legitimate correspondent to a small group or even one
person.

e) Pretexting
 Pretexting, sometimes referred to as phone phishing, is a purely social engineering attack in
which the attacker calls a potential victim on the telephone and pretends to be an authority
figure in order to gain access to private or confidential information, such as health,
employment, or financial records.

6) Information extortion
a) Information extortion
 Information extortion, also known as cyberextortion, is common in the theft of credit card
numbers.
 In 2010, Anthony Digati allegedly threatened to conduct a spam attack on the insurance
company, New York Life. He reportedly sent dozens of e-mails to company executives

Chapter 1 |Introduction to the management of security 13

- Neha Rathi
 threatening to conduct a negative image campaign by sending over 6 million e-mails to
people throughout the country. He then demanded approximately $200,000 to stop the
attack, and next threatened to increase the demand to more than $3 million if the company
ignored him. His arrest thwarted the spam attack.
 In 2012, a programmer from Walachi Innovation Technologies allegedly broke into the
organization's systems and changed the access passwords and codes, locking legitimate
users out of the system. He then reportedly demanded $300,000 in exchange for the new
codes. A court order eventually forced him to surrender the information to the organization.
 In Russia, a talented hacker created malware that installed inappropriate materials on an
unsuspecting user's system, along with a banner threatening to notify the authorities if a
bribe was not paid. At 500 rubles (about $17), victims in Russia and other countries were
more willing to pay the bribe than risk prosecution by less considerate law enforcement.

b) Ransomware
 This attack is usually implemented with malware that is run on the victim's system as a
result of phishing or spear-phishing attacks. The result is that the user's data is encrypted.
 Paying the adversary a ransom in a digital currency may or may not result in the victim
receiving the encryption key to recover the data.
 Waves of attacks in 2017 used ransomware variants such as WannaCry, Petya, and
NotPetya. Loss events to victims of the CryptoWall ransomware attacks in 2014 and 2015
included ransom payments ranging from $200 to $ 10,0 00 per incident as well as costs for
lost productivity, legal fees, and other recovery expenses.
 How do you react if you are the victim of ransomware? Cloud protection and information
management specialists at Druva recommend the following:
1. Do not pay the ransom- There is no guarantee you will get your data back. Druva finds
that one in three organizations affected pay the ransom, yet almost half do not get their data
back.
2. Turn all devices off and disconnect from the network- Try to minimize the spread and
damage from the infection. Shut down th e Wi-Fi service and try to isolate infected systems
so the damage does not spread further.
3. Find the source of the infection- Trying to determine how your systems were infected
can assist you in preventing further spread by informing and educating users.
4. Alert all users- Let everyone know that a ransomware attack is in progress and how not
to get infected. Do not just rely on e-mail to send these alerts- you may want to activate
your phone tree and spread the word that way.
5. Restore from a backup to a new device- Determine if your backups are infected by
eliminating any chance that the infection was present on the computer to which you are
restoring. Then, make sure the data is accessible before porting it to another system.
6. Reimage the infected systems- The only way to be sure ransomware is not lurking in a
hidden file in the operating system, hard drive, or an application is to wipe the infected
systems to their initial state and start over. Many organizations use standard images for
their systems. Wiping all drives clean and reimaging provides a fresh start and some
assurances that the systems will not be immediately reinfected once data is available.

7) Sabotage or Vandalism
 This category of threat involves the deliberate sabotage of a computer system or business, or
Chapter 1 |Introduction to the management of security 14
- Neha Rathi
 acts of vandalism to destroy an asset or damage the image of an organization. These acts can
range from petty vandalism by employees to organized sabotage against an organization.
 Organizations can minimize their risk of Web site defacement by backing up their Web sites
regularly, closely monitoring their Web sites, and minimizing the use of exploitable software
such as scripts, plug-ins, and other application programming interfaces (APIs).

a) Online activism
 There are innumerable reports of hackers accessing systems and damaging or destroying
critical data.
 Hacked Web sites once made frontpage news, as the perpetrators intended. The impact of
these acts has lessened as the volume has increased.
 Today, security experts are noticing a rise in another form of online vandalism, hacktivist or
cyberactivist operations, in which activists hack into a target's online resource, such as e-
mail or social media, and then release that information to the public.

b) Cyber-terrorism & cyberwarfare

 A much more sinister form of hacking is cyberterrorism.
 The United States and other governments are developing security measures intended to
protect critical computing and communications networks as well as physical and power
utility infrastructures.
 Some of these cyberterrorist attacks are perpetrated by individuals, organizations, or
governments and are aimed at disrupting government agencies, while others seem designed
to create mass havoc with civilian and commercial industry targets.
 However, the U.S. government conducts its own cyberwarfare actions, having reportedly
targeted overseas efforts to develop nuclear enrichment plants by hacking into and
destroying critical equipment.
 In April 2015, the Pentagon announced a new strategy for cyberwarfare, identifying China,
Russia, Iran, and North Korea as the countries that represent the greatest threat from
cyberwarfare.

c) Positive online activism

 Not all online activism is negative.
 Social media outlets, such as Facebook, MySpace, Twitter, and YouTube, are commonly
used to perform fundraising, raise awareness of social issues, gather support for legitimate
causes, and promote involvement.
 Modern business organizations try to leverage social media and online activism to improve
their public image and increase awareness of socially responsible actions.

8) Software attacks
 Deliberate software attacks occur when an individual or group designs and deploys software to
attack a system.
 This type of attack is usually part of a campaign that integrates a variety of tools, techniques,
and procedures (TTP) to merge specially crafted software and social engineering methods that
seek to trick users into installing computer code onto their systems.
 Once an infection occurs, the software leverages that foothold by attacking other systems that

Chapter 1 |Introduction to the management of security 15

- Neha Rathi
 can be reached from the newly infected system.
 Attacking software agents usually try to spread to connected systems and then may attempt to
steal information, become an agent of the attacker for other exploits or encrypt users data to be
held for ransom.

a) Malware
 Malware is also referred to as malicious code or malicious software.
 Malicious code attacks include the execution of viruses, worms, Trojan horses, and active
Web scripts with the intent to destroy or steal information.
 The most state-of-the-art malicious code attack is the polymorphic worm, or multivector
worm.
 These attack programs use up to six known attack vectors to exploit a variety of
vulnerabilities in common information system devices.
i) Virus
 A computer virus consists of code segments (programming instructions) that perform
malicious actions.
 The code attaches itself to an existing program and takes control of the program's access
to the targeted computer. The virus- controlled target program then carries out the virus
plan by replicating itself into additional targeted systems.
 When these viruses infect a machine, they may immediately scan it for e-mail
applications or even send themselves to every user in the e-mail address book.
 Viruses can be classified by how they spread themselves. Among the most common
types of information system viruses are the macro virus, which is embedded in
automatically executing macro code used by word processors, spreadsheets, and
database applications, and the boot virus (or boot-sector virus), which infects the key
operating system files in a computer's boot sector.
 Viruses may be classified as memory-resident viruses or nonmemory-resident
viruses, depending on whether they persist in a computer system's memory after they
have been executed.
 Resident viruses are capable of reactivating when the computer is booted and
continuing their actions until the system is shut down, only to restart the next time the
system is booted.

ii) Worms
 A worm can continue replicating itself until it completely fills available resources, such
as memory, hard drive space, and/or network bandwidth.
 The complex behavior of worms can be initiated with or without the user downloading
or executing the file.
 Once the worm has infected a computer, it can redistribute itself to other systems
connected to the compromised systems using e-mail directories and network links found
on the infected system.
 A worm can deposit copies of itself onto all Web servers that the infected system can
reach; users who subsequently visit those sites become infected.

iii) Trojan horses

Chapter 1 |Introduction to the management of security 16

- Neha Rathi
  A Trojan horse may frequently be disguised as a helpful, interesting, or necessary piece
of software, such as the [Link] files often included with shareware or freeware
packages.
 Like their namesake in Greek legend, once Trojan horses are brought into a system,
they become activated and can wreak havoc on the unsuspecting user.
 One historical event occurred on January 20, 1999, when Internet e-mail users began
receiving messages with an attachment of a Trojan horse program named [Link].
 When the e-mail attachment was opened, a brief multimedia program displayed
fireworks and the message "Happy 1999." While the fireworks display was running, the
Trojan horse program was installing itself into the user's system. The program continued
to propagate itself by following up every e-mail the user sent with a second e-mail to
the same recipient and with the same attack program attached.
 Most malware in use gains its initial foothold using this type of Trojan horse behavior,
relying on system users to activate the initial infection with a mouse click or other
means of implied approval.

iv) Polymorphic threats

 A polymorphic threat actually evolves, changing its size and other external file
characteristics to elude detection by antivirus software programs.

v) Virus & worm hoaxes

 More time and money are spent resolving virus hoaxes.
 Well-meaning people can disrupt the harmony and flow of an organization when they
send group e -mails warning of supposedly dangerous viruses that do not exist. When
people fail to follow virus-reporting procedures in response to a hoax, the network
becomes overloaded and users’ waste time and energy forwarding the warning message
to everyone they know, posting the message on bulletin boards, and trying to update
their antivirus protection software.

b) Backdoors
i) Backdoor
 Using a known or newly discovered access mechanism, an attacker can gain access to a
system or network resource through a back door.
 Attackers place a back door into a system or network they have compromised, making
their return to the system that much easier the next time.

ii) Trapdoor
 Viruses and worms can have a payload that installs a back door or trap door component
in a system, allowing the attacker to access the system at will with special privileges.
 A trap door is hard to detect because the person or program that places it often makes
the access exempt from the system's usual audit logging features and makes every
attempt to keep the back door hidden from the system's legitimate owners.

iii) Maintenance door

 Sometimes these doors are left behind by system designers or maintenance staff, and are

Chapter 1 |Introduction to the management of security 17

- Neha Rathi
 thus also referred to as a maintenance hook.

c) DoS & DDoS attacks

 In a denial-of-service (DoS) attack, the attacker sends a large number of connection or
information requests to a target (see Figure 1-6).
 So many requests are made that the target system becomes overloaded and cannot
respond to legitimate requests for service.
 The system may crash or simply become unable to perform ordinary functions.
 In a distributed denial-of-service (DDoS) attack, a coordinated stream of requests is
launched against a target from many locations at the same time.
 Most DDoS attacks are preceded by a preparation phase in which many systems,
perhaps thousands, are compromised.
 The compromised machines are turned into a bot or zombie, a system that is directed
remotely by the attacker (usually via a transmitted command) to participate in the
attack.
 DDoS attacks are more difficult to defend against, and currently there are no controls
that any single organization can apply.
 To use a popular metaphor, DDoS is considered a weapon of mass destruction on the
Internet.
 Any system connected to the Internet and providing TCP-based network services (such
as a Web server, FTP server, or mail server) is vulnerable to DoS attacks.
 DoS attacks can also be launched against routers or other network server systems if
these hosts enable other TCP services, such as echo.

d) E-mail attacks
 Unwanted e-mail, especially bulk commercial e-mail or spam, is a common problem for e-
mail users.

Chapter 1 |Introduction to the management of security 18

- Neha Rathi
  While many consider spam a trivial nuisance rather than an attack, it has been used as a
means of enhancing malicious code attacks.
 Clicking on e-mail attachments, whether in spam or as part of a phishing attack, and
whether through inattention or as a result of clickbaiting, has become a primary means of
initial infection from malware.
 The most significant consequence of spam, however, is the waste of computer and human
resources. Many organizations attempt to cope with the flood of spam by using e-mail
filtering technologies. Other organizations simply tell users of the mail system to delete
unwanted messages.
 The three most common forms of e-mail attacks are wire fraud solicitations, malware
attachments, and clickbait.
 A form of e-mail attack that is also a DoS attack is called a mail bomb.
 It can be accomplished using traditional e-mailing techniques or by exploiting various
technical flaws in the Simple Mail Transport Protocol (SMTP).
 The target of the attack receives an unmanageably large volume of unsolicited e-mail.
 By sending large e -mails with forged header information, attackers can take advantage of
poorly configured e-mail systems on the Internet and trick them into sending many e-mails
to an address of the attackers' choice.
 If many such systems are tricked into participating, the target e-mail address is buried under
thousands or even millions of unwanted e-mails.

e) Communications interception attacks

 Common software-based communications attacks include four subcategories designed to
intercept and collect information in transit. These types of attacks include packet sniffers,
spoofing, pharming, and man-in-the-middle attacks.

i) Packet sniffer
 A packet sniffer (or network sniffer) can monitor data traveling over a network.
 Sniffers can be used both for legitimate network management functions and for stealing
information.
 Unauthorized sniffers can be extremely dangerous to a network's security because they are
virtually impossible to detect and can be inserted almost anywhere.
 This feature makes them a favorite weapon in the hacker's arsenal.
 Sniffers often work on TCP/IP networks.
 Sniffers add risk to networks because many systems and users send information on local
networks in clear text.
 A sniffer program shows all the data going by, including plain-text passwords, the data
inside files (such as word-processing documents), and potentially sensitive data from
applications.

ii) Spoofing
 To engage in IP spoofing, hackers use a variety of techniques to obtain trusted IP
addresses and then modify the packet headers to insert forged addresses.
 Newer routers and firewall arrangements can offer protection against IP spoofing.

Chapter 1 |Introduction to the management of security 19

- Neha Rathi
 iii) Pharming
 Pharming attacks often use Trojans, worms, or other virus technologies to attack an
Internet browser's address bar so that the valid URL the user types is modified to be that
of an illegitimate Web site.
 A form of pharming called Domain Name System (DNS) cache poisoning targets the
Internet DNS system, corrupting legitimate data tables.
 The key difference between pharming and the phishing social engineering attack is that
the latter requires the user to actively click a link or button to redirect to the illegitimate
site, whereas pharming attacks modify the user's traffic without the user's knowledge or
active participation.

iv) Man-in-the-middle attack

 In the well-known man-in-the-middle attack, an attacker monitors (or sniffs) packets
from the network, modifies them, and inserts them back into the network.
 In a TCP hijacking attack, also known as session hijacking, the attacker uses address
spoofing to impersonate other legitimate entities on the network.
 It allows the attacker to eavesdrop as well as to change, delete, reroute, add, forge, or
divert data.
 A variant of TCP hijacking involves the interception of an encryption key exchange,
which enables the hacker to act as an invisible man in the middle- that is, an
eavesdropper- on encrypted communications.

9) Technical hardware failures or errors

 Technical hardware failures or errors occur when a manufacturer distributes equipment
containing a known or unknown flaw.
 These defects can cause the system to perform outside of expected parameters, resulting in
unreliable service or lack of availability.
 Some errors are terminal- that is, they result in the unrecoverable loss of the equipment. Some
errors are intermittent in that they only manifest themselves periodically, resulting in faults
that are not easily repeated. Thus, equipment can sometimes stop working or work in
unexpected ways.

a) MTBF
 The average amount of time between hardware failures, calculated as the total amount of
operation time for a specified number of units divided by the total number of failures.

b) MTTD
 The average amount of time a computer repair technician needs to determine the cause of a
failure.

c) MTTF
 The average amount of time until the next hardware failure.

d) MTTR
 The average amount of time a computer repair technician needs to resolve the cause of a

Chapter 1 |Introduction to the management of security 20

- Neha Rathi
 failure through replacement or repair of a faulty unit.

MTBF = MTTF + MTTD + MTTR

10) Technical software failures or errors

 Large quantities of computer code are written, debugged, published, and sold before all
their bugs are detected and resolved.
 Sometimes, combinations of certain software and hardware reveal new failures that range
from bugs to untested failure conditions.
 Sometimes these bugs are not errors, but purposeful shortcuts left by programmers for
benign or malign reasons.
 Shortcut access routes into programs that bypass security checks are called trap doors, and
they can cause serious security breaches.
 Some errors made during software development are so critical that they have been
characterized as "deadly sins of software security" because they render the software
vulnerable to exploitation in the hostile environment of the Internet.
 These "deadly sins" fall into the four broad categories of Web application sins,
implementation sins, cryptographic sins, and networking sins.

a) Web application sins

 These sins are especially troublesome because in a very real sense, the Web is "the Internet"
to many users.
 Whether posting to social media, making a travel reservation, completing an online
purchase or managing finances, a Web application is the intermediary that implements the
desired functionality.

i) SQL injection
 SQL injection occurs when developers fail to properly validate user input before
passing it on to a relational database.
 The possible effects of an adversary's "injection" of SQL are not limited to improper
access to information, but may include damaging operations such as dropping the
USERS table or perhaps shutting down the database.

ii) Web server related vulnerabilities

 These sins- Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and
Response Splitting- are actually defects in Web applications that exploit how the Web
server renders Web pages to make it appear that an adversary's malicious content is
actually coming from the Web site itself. Thus, the user "trusts" the malicious content to
the same level as the Web site itself.

iii) Web client related vulnerabilities

 This malady is executed within the client's Web browser and often makes use of gadgets
or widgets (mini-applications such as a stock ticker or weather report).
 These mini-applications are often written to minimize footprint and maximize
functionality without consideration for security.

Chapter 1 |Introduction to the management of security 21

- Neha Rathi
 iv) Use of magic URL’s, predictable cookies & hidden form fields
 HTTP is a stateless protocol in which computer programs on either end of the
communication channel cannot rely on a guaranteed delivery of any message.
 This makes it difficult for software developers to track a user's exchanges with a Web
site over multiple interactions.
 Sensitive state information is included in hidden form fields on the HTML page or
simply included in a "magic" URL (for example, the authentication ID is passed as a
parameter in the URL for the exchanges that will follow).
 If this information is stored as plain text, an attacker can harvest the information from a
magic URL as it travels across the network, or use scripts on the client to modify
information in hidden form fields.
 Depending on the structure of the application, the harvested or modified information
can be used in spoofing or hijacking attacks, or to change the way the application
operates.

b) Implementation sins
 These sins are classic programming errors that produce vulnerabilities in running software.

i) Buffer overflow
 Buffers are simply storage space in a program and are normally of some fixed size.
 When used to accept input from an external source (e.g., a form field on a Web page), the
source may supply more information than the buffer was designed to hold and thus
overwrite other areas in the program.
 This may cause the program to abort or the adversary may specially craft the excess data to
cause the program to perform unintended actions.

ii) Format string problems

 Computer languages often are equipped with built-in capabilities to reformat data
while they output it.
 The formatting instructions are usually written as a "format string."
 Unfortunately, some programmers may use data from untrusted sources as a format
string.
 An attacker may embed characters that are meaningful as formatting directives (such
as %x, %d, %p, etc.) into malicious input.
 If this input is then interpreted by the program as formatting directives, the attacker
may be able to access information or overwrite very targeted portions of the program's
stack with data of the attacker's choosing.

iii) Integer overflows

iv) Poor usability

 Users prefer doing things the easy way. When faced with an "official way" of
performing a task and an "unofficial way" - which is easier, they prefer the latter.
 The best solution to address this issue is to provide only one way- the secure way!

Chapter 1 |Introduction to the management of security 22

- Neha Rathi
  Integrating security and usability, adding training and awareness, and ensuring solid
controls all contribute to the security of information.
 Allowing users to choose easier solutions by default will inevitably lead to Joss.

v) Not updating easily

 Software will need to be changed at some point during its lifecycle, to fix a problem,
close security vulnerability, or add new functionality.
 If the updating process is cryptic, users will probably not update their software, which
may then be compromised due to a known and fixed vulnerability.
 As more computing capability is added to devices that do not look like computers,
such as Internet of Things appliances, it becomes less obvious to know whether they
need periodic updates.
 An equally important issue is to assure that updates come from trusted sources.

vi) Executing code with too much privilege

 "Least privilege" is one of the core principles of information security, but it can be
difficult to implement in the real world, as sometimes users do need to perform
privileged operations.
 It is tempting for a developer always to run at the higher privilege level rather than
provide a method for increasing privilege temporarily when it is actually needed.
 The risk is that when a program (or session) is compromised, malicious actions will be
taken at the current privilege level.

vii) Failure to protect stored data

 Storing and protecting data securely is a large enough issue to be the core subject of
this entire text.
 Programmers are responsible for integrating access controls into programs and
keeping secret information out of them.
 Access controls, regulate who, what, when, where, and how users and systems interact
with data.
 Failure to properly implement sufficiently strong access controls makes the data
vulnerable.
 Overly strict access controls hinder business users in the performance of their duties,
and as a result, the controls may be administratively removed or bypassed.

viii) The sins of mobile code

 Mobile code is "code that is downloaded and executed on a user's computer,
sometimes with little or no user consent."
 It is responsible for the liveliness and interactivity of most Web content, but also can
be a rich field for malicious activity.
 The core issue is that mobile code is often downloaded and executed automatically
without the user being aware of it (e.g., the Adobe Flash object that plays an online
video). If the code has vulnerabilities, they can be exploited to affect a compromise.

c) Cryptographic sins

Chapter 1 |Introduction to the management of security 23

- Neha Rathi
  Cryptography is a valuable tool for securing information, but like any tool, it must be used
correctly.
 When cryptography is misused, it often gives the illusion of security while leaving the user
in worse condition than before.

i) Use of weak password based systems

 Failure to require sufficient password strength and to control incorrect password
entry is a serious security issue.
 Password policy can specify the acceptable number and type of characters, the
frequency of mandatory changes, and even the reusability of old passwords.
 Similarly, a system administrator can regulate the permitted number of incorrect
password entries that are submitted and further improve the level of protection.
 Systems that do not validate passwords, or that store passwords in easily accessible
locations, are ripe for attack.

ii) Weak random numbers

 Most modem cryptosystems use random number generators.
 A decision support system that uses random and pseudo-random numbers for Monte
Carlo method forecasting does not require the same degree of rigor and the same
need for true randomness as a system that seeks to implement cryptographic
procedures.
 These "random" number generators use a mathematical algorithm based on a seed
value and another system component (such as the computer clock) to simulate a
random number.
 Those who understand the workings of such a "random" number generator can
predict particular values at particular times.

iii) Using the wrong cryptography

 Many more people use cryptography than actually understand it, and this leads to
cryptographic implementations that fail to deliver their promised contribution to
security.
 Examples of these sins include using a homegrown cryptographic algorithm rather
than a professionally evaluated one such as AES, and poor implementations of key
generation methods that lead to predictable keys (as well as poor operational
procedures for managing keys that may lead to key leakage or loss).

d) Networking sins
 The network is the piping that enables the worldwide flow of information and makes the
Internet such an interesting place.
 However, because it is the medium for all that information flow, it is a rich target.

i) Failure to protect network traffic

 With the growing popularity of wireless networking comes a corresponding increase in the
risk that wirelessly transmitted data will be intercepted.
 Most wireless networks are installed and operated with little or no protection for the

Chapter 1 |Introduction to the management of security 24

- Neha Rathi
 information that is broadcast between the client and the network wireless access point.
 This is especially true of public networks found in coffee shops, bookstores, and hotels.
 Without appropriate encryption such as that afforded by WPA, attackers can intercept and
view your data.

ii) Improper use of PKI, especially SSL

 Programmers use Secure Sockets Layer (SSL) to transfer sensitive data, such as
credit card numbers and other personal information, between a client and server.
 While most programmers assume that using SSL guarantees security, they often
mishandle this technology.
 SSL and its successor, Transport Layer Security {TLS), commonly use certificates
for authenticating entities.
 Failure to validate a PKI certificate and its issuing certificate authority or failure to
check the certificate revocation list (CRL) can compromise the security of SSL
traffic.

iii) Trusting network name resolution

 DNS is vulnerable to attack or "poisoning”.
 DNS cache poisoning involves compromising a DNS server and then changing the
valid IP address associated with a domain name into one the attacker chooses,
usually a fake Web site designed to obtain personal information or one that accrues
a benefit to the attacker- for example, redirecting shoppers from a competitor's Web
site or to a fake "bank" site.
 Aside from a direct attack against a root DNS server, most attacks are made against
primary and secondary DNS servers, which are local to an organization and part of
the distributed DNS system.
 DNS relies on a process of automated updates that can be exploited.
 Attackers most commonly compromise segments of the DNS by attacking the name
of the name server and substituting their own DNS primary name server, by
incorrectly updating an individual record, or by responding before an actual DNS
can.

11) Technological obsolescence

 Antiquated or outdated infrastructure can lead to unreliable and untrustworthy systems.
 Management must recognize that when technology becomes outdated, there is a risk of losing
data integrity from attacks.
 Proper planning by management should prevent technology from becoming obsolete, but when
obsolescence is clear, management must take immediate action.
 IT professionals play a large role in the identification of probable obsolescence.
 Perhaps the most significant case of technology obsolescence in recent years is Microsoft's
Windows XP. This desktop operating system, introduced in 2001, dominated the market for
many years. The OS evolved to be used in multiple variations such as XP Pro and XP Home,
had feature and capability upgrades in three service packs, and even made the transition to new
processors with a 64-bit edition. It was superseded in the corporation's lineup of desktop
operating systems by Microsoft Vista in January 2007. However, XP still retains an estimated

Chapter 1 |Introduction to the management of security 25

- Neha Rathi
 250 million users worldwide as of rnid-2016. Microsoft discontinued support for Windows XP
in April 2014. This removal of support was expected to cause concern and perhaps even
disruptions in some business sectors, notably the utility industry.
 Many industries and organizations built critical elements of their business systems and even
their infrastructure control systems on top of Windows XP, or they used it as an embedded
operating system inside other systems, such as automated teller machines and power generating
and control systems.
12) Theft
 The value of information is diminished when it is copied without the owner's knowledge.
 Electronic theft is a more complex problem to manage and control.
 When someone steals a physical object, the loss is easily detected; if it has any importance at
all, its absence is noted.
 When electronic information is stolen, the crime is not always readily apparent.
 If thieves are clever and cover their tracks carefully, the crime may remain undiscovered until it
is too late.
 Theft is often an overlapping category with software attacks, espionage or trespass, information
extortion, and compromises to intellectual property.
 A hacker or other individual threat agent could access a system and commit most of these
offenses if they downloaded a company's information and then threatened to publish it if not
paid.

5) Management & Leadership

 Management involves using resources to get a job done.
 A manager is a member of the organization assigned to marshal and administer resources,
coordinate the completion of tasks, and handle the many roles necessary to complete the
desired objectives.
 Managers have many roles to play within organizations, including the following:
 Informational role- Collecting, processing, and using information that can affect the
completion of the objective
 Interpersonal role- Interacting with superior’s subordinates, outside stakeholders, and
other parties that influence or are influenced by the completion of the task
 Decisional role- Selecting from among alternative approaches and resolving conflicts,
dilemmas, or challenges
 differences between leadership and management-
 A leader does more than a manager. He or she is expected to lead by example and
demonstrate personal traits that instill a desire in others to follow.
 By comparison, a manager administers the resources of the organization. He or she
creates budgets, authorizes expenditures, and recruits, hires, evaluates, and terminates
employees.
 This distinction between a leader and a manager is important because leaders do not
always perform a managerial function, and managers are often assigned roles in which
they are not responsible for personnel.
 Effective managers can also be effective leaders.

Chapter 1 |Introduction to the management of security 26

- Neha Rathi
 1) Types of Leaders-
 Among leaders, there are three basic behavioral types: autocratic, democratic, and laissez-
faire.

Autocratic leaders
 Reserve all decision-making responsibility for themselves and are "do as I say" types.
 Such leaders typically issue an order to accomplish a task and do not usually seek or
accept alternative viewpoints.
 The autocratic leader may be more efficient given that he or she is not constrained by the
necessity to accommodate alternative viewpoints.
 The autocratic leader may be the less effective if his or her knowledge is insufficient for
the task.

Democratic leaders
 Work in the opposite way, typically seeking input from all interested parties, requesting
ideas and suggestions, and then formulating positions that can be supported by a majority.
 Each of these two diametrically opposed approaches has its strengths and weaknesses.
 The democratic leader may be less efficient because valuable time is spent in discussion
and debate when planning for the task.
 The democratic leader may be more effective when dealing with very complex topics
and/or those in which subordinates have strongly held opinions.

Laissez-faire leader
 Also known as the "laid-back" leader.
 While both autocratic and democratic leaders tend to be action oriented, the laissez-faire
leader often sits back and allows the process to develop as it goes, only making minimal
decisions to avoid bringing the process to a complete halt.
 Effective leaders function with a combination of these styles, shifting approaches as
situations warrant.
 For example, depending on the circumstances, a leader may solicit input when the
situation permits, make autocratic decisions when immediate action is required, and allow
the operation to proceed with little direct intervention if it is progressing in an efficient
and effective manner.

2) Management characteristics-
 The management of tasks requires certain basic skills. These skills are variously referred to as
"management characteristics," "management functions;' "management principles;• or
"management responsibilities."
 The two basic approaches to management are:
• Traditional management theory- This approach uses the core principles of planning,
organizing, staffing, directing, and controlling (POSDC).
• Popular management theory- This approach uses the core principles of planning,
organizing, leading, and controlling (POLC).

1) Planning

Chapter 1 |Introduction to the management of security 27

- Neha Rathi
  The process of developing, creating, and implementing strategies for the accomplishment
of objectives is called planning.
 The three levels of planning are:
i) Strategic planning- This occurs at the highest levels of the organization and for a long
period of time, usually five or more years.
ii) Tactical planning- This focuses on production planning and integrates organizational
resources at a level below the entire enterprise and for an intermediate duration (such as
one to five years).
iii) Operational planning- This focuses on the day-to-day operations of local resources
and occurs in the present or the short term.
 There is also a category of planning used in non-normal business operations called
contingency planning.
 Lack of planning can cause the kind of confusion and frustration among managers and staff
 The planning process begins with the creation of strategic plans for the entire organization.
 The resulting plan is then divided into planning elements relevant to each major business
unit of the organization.
 These business units in turn create business plans that meet the requirements of the overall
organizational strategy.
 The plans are communicated to midlevel managers so that they can create tactical plans
with intermediate objectives that, if successful, would result in achievement of the strategic
plan's goals.
 Supervisors use the tactical plans to create operational plans that guide the day-to-day
operations of the organization.
 To better understand its planning process, an organization must thoroughly define its goals
and objectives.
 While the exact definition varies depending on context, the term goal refers to the end
result of a planning process- for example, increasing market share by two percent.
 The term objective refers to an intermediate point that allows you to measure progress
toward the goal- for example, a growth in sales for each quarter.

Chapter 1 |Introduction to the management of security 28

- Neha Rathi
 2) Organizing
 The management function dedicated to the structuring of resources to support the
accomplishment of objectives is called organizing.
 It includes the structuring of departments and their associated staffs, the storage of raw
materials to facilitate manufacturing, and the collection of information to aid in the
accomplishment of the task.
 Recent definitions of "organizing" include staffing, because organizing people so as to
maximize their productivity is not substantially different from organizing time, money, or
equipment.

3) Leading
 Leading encourages the implementation of the planning and organizing functions.
 It includes supervising employee behavior, performance, attendance, and attitude while
ensuring completion of the assigned tasks, goals, and objectives.
 Leadership generally addresses the direction and motivation of the human resource.

4) Controlling
 Controlling ensures the validity of the organization's plan.
 The manager ensures that sufficient progress is made, that impediments to the completion
of the task are resolved, and that no additional resources are required.
 Should the plan be found invalid in light of the operational reality of the organization, the
manager takes corrective action.
 The control function relies on the use of cybernetic control loops, often called "negative
feedback."
 These involve performance measurements, comparisons, and corrective actions, as shown
in Figure.
 Here, the cybernetic control process begins with a measurement of actual performance,
which is then compared to the expected standard of performance as determined by the
planning process.
 If the standard is being met, the process is allowed to continue toward completion. If an
acceptable level of performance is not being attained, either the process is corrected to
achieve satisfactory results or the expected level of performance is redefined.

Chapter 1 |Introduction to the management of security 29

- Neha Rathi
 5) Governance
 The very top of an organization includes a special level of management that involves
planning, organizing, leading, and controlling the information security function.
 For most organizations that have such a governing body, it exists either at the board of
directors level or the senior executive level.
 This level of uppermost management is referred to as governance.
 Governance emphasizes escalating the importance of InfoSec to the uppermost levels of the
organization and providing it with an appropriate level of management.
 In more mature organizations that have long-established InfoSec programs, governance
structures provide oversight and increased attention to the various InfoSec functions,
specifically those addressing risk management, performance measures, and regulatory
compliance.
 Risk management is made up of processes an organization implements to identify assets,
assess risks to those assets, and reduce potential losses. Performance measures are
identified evaluative criteria that an organization chooses to collect and evaluate in order to
gain essential feedback on its quantitative and qualitative performance.
 Regulatory compliance is the set of actions an organization undertakes to assure
government and other evaluators that it is in compliance with governmental or industry
laws, regulations, or standards.

Chapter 1 |Introduction to the management of security 30

- Neha Rathi
 3) Solving Problems
 Whether a problem is low or high profile, the same basic process can be used to solve it.
 Time pressures often constrain decision making when problems arise.
 The process of gathering and evaluating the necessary facts may be beyond available
capabilities.
 Nevertheless, the methodology described in the following steps can be used as a basic
blueprint for resolving many operational problems.

Step 1: Recognize and Define the Problem

 The most frequent flaw in problem solving is failing to define the problem completely.
 Begin by clearly identifying exactly which problem needs to be solved.

Step 2: Gather Facts and Make Assumptions

 To understand the background and events that shape the problem, a manager can gather facts
about the organizational, cultural, technological, and behavioral factors that are at the root of
the issue.
 He or she can then make assumptions about the methods that are available to solve the
problem.

Step 3: Develop possible solutions

 Managers can use several methods to generate ideas.
 One of these is brainstorming, a process in which a group of individuals airs as many ideas
as possible in a short time, without regard for their practicality.
 The group then reviews and filters the ideas to identify any feasible options.
 Problem solvers can also interview experts or perform research into solutions using the
Web, magazines, journals, or books.
 In any case, the goal is to develop as many solutions as possible.

Step 4: Analyze and Compare Possible Solutions

 Each proposed solution must be examined and ranked as to its likely success in solving the
problem.
 This analysis may include reviewing economic, technological, behavioral, and operational
feasibilities, which are described as:
• Economic feasibility - Comparing the costs and benefits of a possible solution with other
possible solutions.
• Technological feasibility- Assessing the organization's ability to acquire the technology
needed to implement a particular solution.
 Behavioral feasibility- Assessing the likelihood that subordinates will adopt and support
a particular solution rather than resist it.
• Operational feasibility- Assessing the organization's ability to integrate a particular
solution into its current business processes.

Chapter 1 |Introduction to the management of security 31

- Neha Rathi
 Step 5: Select, Implement, and Evaluate
 Once a solution is chosen and implemented, it must be evaluated to determine its effectiveness in
solving the problem.
 It is important to monitor the chosen solution carefully so that if it proves ineffective, it can be
canceled or altered quickly.

6) Principles of Information Security Management

 The InfoSec management team's goals and objectives differ from those of the IT and general
management communities in that the InfoSec management team is focused on the secure
operation of the organization.
 In fact, some of the InfoSec management team's goals and objectives may be contrary to or
require resolution with the goals of the IT management team.
 The primary focus of the IT group is to ensure the effective and efficient processing of
information, whereas the primary focus of the InfoSec group is to ensure the confidentiality,
integrity, and availability of information.
 Security, by its very nature, will slow down the information flow into, through, and out of an
organization as information is validated, verified, and assessed against security criteria.
 Because the chief information security officer {CISO) in charge of the security management
team typically reports directly to the chief information officer {CIO), who is responsible for the
IT function, issues and prioritization conflicts can arise unless upper management intervenes.
 Because InfoSec management is in charge of a specialized program, certain aspects of its
managerial responsibility are unique. These unique functions, which are known as "the six Ps"
(planning, policy, programs, protection, people, and project management), are as follows:

1) Planning
 Planning in InfoSec management includes InfoSec planning model which are activities
necessary to support the design, creation, and implementation of InfoSec strategies within
the planning environments of all organizational units, including IT.
 Because the InfoSec strategic plans must support not only the IT use and protection of
information assets, but also those of the entire organization, it is imperative that the CISO
work closely with all senior managers in developing InfoSec strategy.
 The business strategy is translated into the IT strategy. The strategies of other business
units and the IT strategy are then used to develop the InfoSec strategy.
 Just as the CIO uses the IT objectives gleaned from the business unit plans to create the
organization's IT strategy, the CISO develops InfoSec objectives from the IT and other
business units to create the organization's InfoSec strategy.
 The IT strategy and that of the other business units provides critical information used for
InfoSec planning as the CISO gets involved with the CIO and other executives to develop
the strategy for the next level down.
 The CISO then works with the appropriate security managers to develop operational
security plans. These security managers consult with security technicians to develop
tactical security plans.
 Each of these plans is usually coordinated across the business and IT functions of the
enterprise and placed into a master schedule for implementation.
Chapter 1 |Introduction to the management of security 32
- Neha Rathi
  The overall goal is to create plans that support long-term achievement of the overall
organizational strategy.
 If all goes as expected, the entire collection of tactical plans accomplishes the operational
goals and the entire collection of operational goals accomplishes the subordinate strategic
goals; this helps to meet the strategic goals and objectives of the organization as a whole.
 Several types of InfoSec plans and planning functions exist to support routine and non-
normal operations.
 These include incident response planning, business continuity planning, disaster recovery
planning, policy planning, personnel planning, technology rollout planning, risk
management planning, and security program planning.

2) Policy
 In InfoSec, there are three general policy categories, which are
i) Enterprise Information Security Policy (EISP)-
 Developed within the context of the strategic IT plan, this sets the tone for the
InfoSec department and the InfoSec climate across the organization.
 The CISO typically drafts the program policy, which is usually supported and
signed by the CIO or the CEO.
ii) Issue-Specific Security Policies (ISSPs)-
 These are sets of rules that define acceptable behavior within a specific
organizational resource, such as e-mail or Internet usage.
iii) System-Specific Policies (SysSPs)-
 A merger of technical and managerial intent, SysSPs include both the managerial
guidance for the implementation of a technology as well as the technical
specifications for its configuration.

3) Programs
 InfoSec operations that are specifically managed as separate entities are called "programs”.
 An example would be security education training and awareness (SETA) program, a risk
management program, or contingency programs such as incident response, disaster recovery,
or business continuity.
 SETA programs provide critical information to employees to maintain or improve their
current levels of security knowledge.
 Risk management programs include the identification, assessment, and control of risks to
information assets.
 Contingency programs prepare the organization for non-normal business operations such as
reacting to an incident or disaster, which may require the organization to relocate to an
alternate site at least temporarily.
 Other programs that may emerge include a physical security program, complete with fire
protection, physical access, gates, guards, and so on.
 Some organizations with specific regulations may have additional programs dedicated to
client/customer privacy, awareness, and the like.
 Each organization will typically have several security programs that must be managed.

4) Protection

Chapter 1 |Introduction to the management of security 33

- Neha Rathi
  The protection function is executed via a set of risk management activities, as well as
protection mechanisms, technologies, and tools.
 Each of these mechanisms or safeguards represents some aspect of the management of
specific controls in the overall InfoSec plan.

5) People
 People are the most critical link in the InfoSec program.
 This area encompasses security personnel (the professional information security
employees), the security of personnel (the protection of employees and their information),
and aspects of the SETA program.

6) Projects
 Whether an InfoSec manager is asked to roll out a new security training program or select
and implement a new firewall, it is important that the process be managed as a project.
 The final element for thoroughgoing InfoSec management is the application of a project
management discipline to all elements of the InfoSec program.
 Project management involves identifying and controlling the resources applied to the
project, as well as measuring progress and adjusting the process as progress is made
toward the goal.

Chapter 1 |Introduction to the management of security 34

- Neha Rathi