- Introduction
- Principle 1: There Is No Such Thing As Absolute Security
- Principle 2: The Three Security Goals Are Confidentiality, Integrity, and Availability
- Principle 3: Defense in Depth as Strategy
- Principle 4: When Left on Their Own, People Tend to Make the Worst Security Decisions
- Principle 5: Computer Security Depends on Two Types of Requirements: Functional and Assurance
- Principle 6: Security Through Obscurity Is Not an Answer
- Principle 7: Security = Risk Management
- Principle 8: The Three Types of Security Controls Are Preventative, Detective, and Responsive
- Principle 9: Complexity Is the Enemy of Security
- Principle 10: Fear, Uncertainty, and Doubt Do Not Work in Selling Security
- Principle 11: People, Process, and Technology Are All Needed to Adequately Secure a System or Facility
- Principle 12: Open Disclosure of Vulnerabilities Is Good for Security!
- Summary
- Test Your Skills
This chapter is from the book
This chapter is from the book
This chapter is from the book
Test Your Skills
Multiple Choice Questions
Which of the following represents the three goals of information security?
- Confidentiality, integrity, and availability
- Prevention, detection, and response
- People controls, process controls, and technology controls
- Network security, PC security, and mainframe security
Which of the following terms best describes the assurance that data has not been changed unintentionally due to an accident or malice?
- Availability
- Confidentiality
- Integrity
- Auditability
Related to information security, confidentiality is the opposite of which of the following?
- Closure
- Disclosure
- Disaster
- Disposal
The CIA triad is often represented by which of the following?
- Triangle
- Diagonal
- Ellipse
- Circle
Defense in depth is needed to ensure that which three mandatory activities are present in a security system?
- Prevention, response, and prosecution
- Response, collection of evidence, and prosecution
- Prevention, detection, and response
- Prevention, response, and management
Which of the following statements is true?
- The weakest link in any security system is the technology element.
- The weakest link in any security system is the process element.
- The weakest link in any security system is the human element.
- Both B and C
Which of the following best represents the two types of IT security requirements?
- Functional and logical
- Logical and physical
- Functional and assurance
- Functional and physical
Security functional requirements describe which of the following?
- What a security system should do by design
- What controls a security system must implement
- Quality assurance description and testing approach
- How to implement the system
Which of the following statements is true?
- Security assurance requirements describe how to test the system.
- Security assurance requirements describe how to program the system.
- Security assurance requirements describe to what degree the testing of the system is conducted.
- Security assurance requirements describe implementation considerations.
Which of the following terms best describes the probability that a threat to an information system will materialize?
- Threat
- Vulnerability
- Hole
- Risk
Which of the following terms best describes the absence or weakness in a system that may possibly be exploited?
- Vulnerability
- Threat
- Risk
- Exposure
Which of the following statements is true?
- Controls are implemented to eliminate risk and eliminate the potential for loss.
- Controls are implemented to mitigate risk and reduce the potential for loss.
- Controls are implemented to eliminate risk and reduce the potential for loss.
- Controls are implemented to mitigate risk and eliminate the potential for loss.
Which of the following terms best describes a cookbook on how to take advantage of a vulnerability?
- Risk
- Exploit
- Threat
- Program
Which of the following represents the three types of security controls?
- People, functions, and technology
- People, process, and technology
- Technology, roles, and separation of duties
- Separation of duties, processes, and people
Which of the following statements is true?
- Process controls for IT security include assignment of roles for least privilege.
- Process controls for IT security include separation of duties.
- Process controls for IT security include documented procedures.
- All of the above
Exercises
EXERCISE 2.1: Understanding the Importance of Information Confidentiality
Why is confidentiality important to corporate information? What kinds of abuses can you think of in the absence of controls on confidentiality? What criminal activities could be reduced or eliminated if confidentiality controls were effectively implemented?
EXERCISE 2.2: Evaluating Real-World Defense in Depth
Find some analogies to the principle of defense in depth in the physical world, and make some diagrams of the mechanism you locate. Consider how a bank implements defense in depth and how corporations protect themselves from intruders entering their buildings.
EXERCISE 2.3: Avoiding Security Through Obscurity
Why is security through obscurity a bad idea for the overall security of a system?
EXERCISE 2.4: Identifying a Phishing Scam
Go to www.opendns.com/phishing-quiz/ and take the “Think You Can Outsmart Internet Scammers?” quiz. How well did you perform at identifying phishing scams?
EXERCISE 2.5: Evaluating Risk Management
Every day, you make risk-management decisions in your daily life. Should you get in the car and drive to the store? Should you jaywalk or cross at the light? Should you get on that airplane? Think about the risk-management decisions you make when using your PC:
- What kinds of judgments do you make before downloading a piece of software?
- What kinds of judgments do you make before writing an email to your boss?
- What mental steps do you go through before taking some action?
Projects
mPROJECT 2.1: Understanding Email-Borne Viruses
- Visit one or more of the antivirus software developer sites (Symantec, MacAfee, Computer Associates, Trend Micro, and so forth), and see if you can identify which viruses and worms require a user to click on an email attachment to replicate.
- Trace the sophistication of the virus writers over time, and try to determine how they circumvent any improvements in user awareness of and education toward preventing viruses from spreading.
PROJECT 2.2: Researching Hackers
Open disclosure of software vulnerabilities is often associated with gray-hat hackers, described as security researchers who aren’t particular about who learns about their findings. Research the three types of hackers (white hat, gray hat, and black hat), and try to determine their typical positions on full disclosure of software problems before patches or new versions of the software are made available in the marketplace. Use Google or your favorite Internet search engine with a query of “Open Disclosure of Software Vulnerabilities” to help you formulate your answers.
PROJECT 2.3: Comparing Physical and Virtual Risk-Management Techniques
- How is risk management for physical systems similar to risk management for computer systems?
- How are the two different?
- What skill sets are required for each type?