CS205 Learning Materials

1 - 105.

IT Security functions

•  Network security
•  Systems security
•  Application & database security
•  Mobile security

InfoSec functions

•  Governance
•  Policies & procedures
•  Risk management
•  Performance reviews
•  Confidentiality keeping information secret
•  Integrity Keeping information in its original form
•  Availability Keeping information and information systems available for use

Who Is Information Security For?

•  Personal Social media passwords and safe usage Online banking and email account passwords Home PC/laptop security Mobile security
•  Organizational Board and executive leadership CISO IT staff and business users
•  Govt and national Law enforcement Legal and policy making National database Regulation Standards and certification

Difference between Policy, SOP & Guideline

Policy · SOP · Guideline · Standard

Formal and high level requirement for securing the organization and its IT assets. More detailed description of the process; who does what, when, and how General recommendation or statement of best practice Specific and mandatory action or rule

Scope is across organization so should be brief and focusing on desired results Scope is predominantly at a department level having specified audience Not mandatory Must include one or more specifications for an IT asset or behavior Signed off by senior Management May be signed off by departmental head Further elaborates the related SOP Yardstick to help achieve the policy goals InfoSec Manager Tasks

•  Develop policy
•  Design security controls
•  Ensure controls are implemented
•  Conduct risk assessment
•  Conduct security testing

NIST Special Publication 800-50

•  Awareness
•  Training
•  Education

What Is Information Security Awareness?

•  Don’ts Share your password Click on suspicious email links Install unlicensed software on your PC
•  Do’s Logout when getting up from your system Report security incidents