Premium Essay

Information Security and Technology

In: Computers and Technology

Submitted By vx8550
Words 422
Pages 2
1. What is the difference between a threat agent and a threat?
A threat agent is a specific instance or a component of a threat. A threat is a category of objects, persons, or other entities that presents a danger to an asset. 2. What is the difference between vulnerability and exposure?
Vulnerability is a weakness or fault in a system or protection mechanism that opens it to attack or damage. Exposure is the condition or state of being exposed. 3. What are the three components of the CIA triangle? What are they used for?
The three components of the CIA triangle are confidentiality, integrity, and availability. Confidentiality is used to protect information from disclosure or exposure to unauthorized individuals or systems. Integrity is when information is a whole, complete, and uncorrupted. Availability is used to enable authorized users to access information without interference and to receive it in the required format. 4. Describe the critical characteristics of information. How are they used in the study of computer security?
The critical characteristics of information is the value of information it possesses. If a characteristic change, the value of information also changes. There are seven critical characteristics which are:
Availability - enable authorized users to access information without interference or obstruction and receives it in the required format.
Accuracy - information that is free from errors and it has the value that the end user expects
Authenticity - quality or state of being genuine or original, not a reproduction or fabrication. Information is authentic when it is in the same state in which it was created, placed, stored, or transferred.
Confidentiality - information that is protected from disclosure or exposure to unauthorized individuals or systems. It ensures that only those with the rights and privileges to access...

Similar Documents

Premium Essay

Information Security Technologies

...Research Paper: Information Security Technologies by Benjamin Tomhave November 10, 2004 Prepared for: Professor Dave Carothers EMSE 218 The George Washington University This paper or presentation is my own work. Any assistance I received in its preparation is acknowledged within the paper or presentation, in accordance with academic practice. If I used data, ideas, words, diagrams, pictures, or other information from any source, I have cited the sources fully and completely in footnotes and bibliography entries. This includes sources which I have quoted or paraphrased. Furthermore, I certify that this paper or presentation was prepared by me specifically for this class and has not been submitted, in whole or in part, to any other class in this University or elsewhere, or used for any purpose other than satisfying the requirements of this class, except that I am allowed to submit the paper or presentation to a professional publication, peer reviewed journal, or professional conference. In adding my name following the word 'Signature', I intend that this certification will have the same authority and authenticity as a document executed with my hand-written signature. Signature _____Benjamin L. Tomhave________________________ Benjamin L. Tomhave 12/7/2004 1 Research Paper: Information Security Technologies by Benjamin L. Tomhave Abstract The following research paper provides analysis of thirteen (13) information security technology topics, arranged in ten......

Words: 12903 - Pages: 52

Premium Essay

Information Technology/Network Security Threats

...password, policy, to educate the users. SECURITY CONSIDERATIONS IN THE INFORMATION SYSTEM DEVELOPMENT LIFE CYCLE. Each information security environments unique, unless modified to adapt to meet the organization’s needs. The System Development Life Cycle (SDLC) the system development life cycle starts with the initiation of the system planning process, and continues through system acquisition and development, implementation, operations and maintenance, and ends with disposition of the system. Service decisions about security made in each of these phases to assure that the system is secure. The initiation phase begins with a determination of need for the system. The organization develops its initial definition of the problem that solved through automation. This followed by a preliminary concept for the basic system that needed, a preliminary definition of requirements, and feasibility and technology assessments. Also during this early phase, the organization starts to define the security requirements for the planned system. Management approval of decisions reached is important at this stage. The information developed in these early analyses used to estimate the costs for the entire life cycle of the system, including information system security. An investment analysis determine the appropriate strategy for achieving the system requirements, while taking mission needs and budget constraints into account. Expenditures for security before the system built. It......

Words: 1444 - Pages: 6

Premium Essay

Security Policy

...Document Information | |Title: |MCSD IT Security Plan  | |Type: |MCSD Procedural Plan | |Audience: |MCSD IT Employees and Management | |Approval Authority: |Assistant Superintendent for Technology & Personnel | |Contact: |mail to: bakatsm@marlboroschools.org   | |Status: |Proposed: |January 17, 2010 | | |Approved: |TBA |   [pic] MARLBORO CENTRAL SCHOOL DISTRICT Information Technology Security Plan                  January 17th, 2010 Table of Contents Introduction................................................................................................................ 3 Information Technology Security Safeguards........................................................... 4 Physical Security....................................................................................................... 5 Personnel......

Words: 3526 - Pages: 15

Premium Essay

Staffing the It Department

...the Information Technology Department Gayle Yarbrough, PHR Webster University ITM 5600/45 - Information and Communications Security Dr. Etido Akpan February 15, 2011 Abstract Staffing the Information Technology (IT) department today is about proper workforce planning and strategic alignment. In today’s labor market, it is essential that staffing be aligned with the strategic plan of the organization. The goal of the staffing expert is to achieve the perfect balance between improving technology and finding success in all areas related to staffing for that technology (Cryton, 2010). Strategic recruiting becomes more important as labor markets shift and become more competitive. Human Resource planning helps to align Human Resource strategies with organizational goals and plans. This research will examine different strategies and staffing approaches as companies strive to attract the Information Technology talent needed while at the same time companies are facing a major human energy crisis in the Information Technology department. This study will examine the different methods and sources of staffing and considerations to examine in selecting a recruitment strategy. The research will examine what is needed to staff the IT department along with credentials and training needed to support the requirements. Finally, the research will conclude with employment policies and practices to that should be closely examined and considered when staffing the Information......

Words: 3035 - Pages: 13

Premium Essay

Cyber Security Act

...4Department of Information Technology Ministry of Communications and Information Technology Government of India Electronics Niketan, Lodhi Road New Delhi – 110003 Discussion draft on National Cyber Security Policy “For secure computing environment and adequate trust & confidence in electronic transactions ” Your comments/feedback on this document are most welcome. Please send your valuable comments/feedback by 15 May 2011 to Dr Gulshan Rai, Director General, CERT-In, at the at the above address or on email id ‘grai@mit.gov.in’ Discussion draft Department Of Information Technology National Cyber Security Policy “For secure computing environment and adequate trust & confidence in electronic transactions ” Contents 1.0 Security of Cyber Space – Strategic perspective 1.1 IT as an engine for economic growth and prosperity 1.2 Security of cyber space - Need for action 1.3 Target audience 1.4 Securing cyber space – Key policy considerations 2.0 Cyber space – Nature of threat 2.1 Threat landscape 2.2 International cooperation 2.3 Securing cyber space – Scope of action 2.3.1 Cyber security and cyber defense 2.3.2 Cyber intelligence and cyber defense 2.4 Priorities for action 2.5 Partnership and collaborative efforts 3.0 Enabling processes 3.1 Security threat and vulnerability management 3.2 Security threat early warning and response 3.3 Security best practices - compliance and assurance 3.4 Security crisis management plan for countering cyber attacks and cyber......

Words: 7888 - Pages: 32

Premium Essay

It Auditing

...Information Technology Auditing XX Jul 13 Information Technology Auditing In this paper we will be discussing the process of auditing in the information technology environment. Auditing within information technology can go several different was and focus on different aspect of information technology. The auditing process can be as simple as the review of software and extend all the way up to intricate aspects of a Government established information systems security features. The process of auditing will need to be completed by trained and experienced professional in order to be successful and make the end project survive the current changes in the information technology field. Most of the information technology communities fall within the parameters of two types of auditing, which are information technology auditing and information security auditing. We first discuss the concept of information technology auditing. Information technology management is the process of examining the controls within an information technology infrastructure. The information technology auditing process conduct an extensive evaluation and can determine if the established information system are doing their jobs. The process ensures the current information systems safeguarding stored assets, maintaining its system integrity and last but not least meeting the objectives and goals of the company deploying the system. This audit can be done at anytime encompassed with any other......

Words: 886 - Pages: 4

Premium Essay

Information Assurance

...Framework Computer Security Division Information Technology Laboratory NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 1 Managing Enterprise Risk Key activities in managing enterprise-level risk—risk resulting from the operation of an information system: Categorize the information system Select set of minimum (baseline) security controls Refine the security control set based on risk assessment Document security controls in system security plan Implement the security controls in the information system Assess the security controls Determine agency-level risk and risk acceptability Authorize information system operation Monitor security controls on a continuous basis NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 2 Risk Management Framework Starting Point CATEGORIZE Information System Define criticality/sensitivity of information system according to potential worst-case, adverse impact to mission/business. MONITOR Security State Continuously track changes to the information system that may affect security controls and reassess control effectiveness. SELECT Security Controls Select baseline security controls; apply tailoring guidance and supplement controls as needed based on risk assessment. Security Life Cycle AUTHORIZE Information System Determine risk to organizational operations and assets, individuals, other organizations, and the Nation; if acceptable, authorize operation. IMPLEMENT Security Controls Implement security......

Words: 723 - Pages: 3

Premium Essay

The Internet

...Lucia Managing Information Technology Security isn’t simply a technology issue, it’s a business issue. Discuss In any given organization information technology generally refers to laptop and desktop computers, servers, routers, and switches that form a computer network, although information technology also includes fax machines, phone and voice mail systems, cellular phones, and other electronic systems. A growing reliance on computers to work and communicate have made the control of computer networks an important part of information security. Security days as just a technical or technology issue are done. It is becoming a central concern for leaders at the highest level of many organizations and governments, transcending national borders. Customers are demanding the highest security, as worries about privacy, the protection of personally identifiable information, and identity theft grow. Business partners, suppliers, and vendors are requiring it from one another, particularly when providing mutual network and information access. Networked efforts to steal competitive intelligence and engage in extortion are becoming more prevalent and widespread. Security breaches and data disclosure increasingly arise from criminal behavior motivated by financial gain. As additional evidence of this growing trend is sort, the Deloitte 2007 Global Security Survey of top global financial services institutions states the following and I quote “Information security is no......

Words: 989 - Pages: 4

Premium Essay

Business Reserach Final Paper

...growth in today's society. Technology advancements allow organization to create more jobs which, improves the economy. The advantages of technology advances allows businesses to be more efficient and employees to work in the field but have the technology to use as if they were sitting at their desk. With the benefits of technological advancements there are also many disadvantages. Technological advancements can cause security issues that can harm the organization as well as consumers. Researching and obtaining the necessary information regarding technological advancements and understanding security issues is critical to any organization. Purpose of the research The purpose of this research plan is to determine how technology will affect business’s finances and level of security. The quantitative research method is the preferred method in this case, its ability to produce objective accurate results based on the results. As a research team we are going to remain objective and keep distance from the research to keep the information obtained as accurate as possible. We will be researching technological advancements and also use technology to our advantage in researching this issue. The amount of information that is available in regard to new technological products is enormous and should provide more than enough data to come to a conclusion. Solution to the Issue Cloud computing is a security system that specializes in security, privacy, and......

Words: 1895 - Pages: 8

Premium Essay

Information Systems Security Policy

...MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) Revision 8.0 August, 2013 ________________________________________________________________________ 1 MICROS Systems, Inc. Enterprise Information Security Policy Version 8.0 Public Table of Contents Overview – Enterprise Information Security Policy/Standards: I. Information Security Policy/Standards – Preface……………....5 I.1 Purpose …………….……………………………………………...5 I.2 Security Policy Architecture ………………….………………….6 I.3 Relation to MICROS Systems, Inc. Policies……………………..6 I.4 Interpretation………………………………………………….…..7 I.5 Violations…………………………………………………….….....7 I.6 Enforcement…………………………………………….................7 I.7 Ownership………………………………………………................7 I.8 Revisions…………………………………………………………..7 II. Information Security Policy - Statement………………………..8 MICROS Enterprise Information Security Policy (MEIP): 1. Information Security Organization Policy (MEIP-001)...……....9 2. Access Management Policy (MEIP-002)…………………………10 3. Systems Security Policy (MEIP-003)...…….…………………......11 4. Network Security Policy (MEIP-004)…………………………….12 ________________________________________________________________________ 2 MICROS Systems, Inc. Enterprise Information Security Policy Version 8.0 Public 5. Application Security Policy (MEIP-005)…..………………………13 6. Data Security/Management Policy (MEIP-006)……………….14-15 7. Security Incident Handling......

Words: 4971 - Pages: 20

Premium Essay

Security Awareness

...Information Security - Security Awareness Abstract: 3 Security Awareness 4 Regulatory Requirements for Awareness and Training 7 References 13 Abstract: Information security means protecting information and information systems (IS) from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. A policy can be described as a set of principles intended to manage actions. An Information Security Policy (ISP) is a defined set of principles intended to protect information and information systems by controlling the actions allowed within an organization. There is not a single off the shelf approach to implement an ISP. The ISP is tailored to the specific organization and defined by the environment of the IS, the classification of the information, governance and compliance laws, and the levels of acceptable risk to the organization. An IPS has many areas to cover but the most prominent subject matter is risk management. Risk management addresses an organization's assets exposure to environmental risks. Since risk management is continuous and must be reevaluated whenever changes are introduced into the environment or when a breach of the policy has occurred so should the ISP. Policies must be useable, workable and realistic. In order to truly measure the effectiveness of an ISP measurements or metrics must be defined in order to grade or rate the effectives. ISPs that are not applicable,......

Words: 2691 - Pages: 11

Premium Essay

Testing

...NIST Special Publication 800-39 Managing Information Security Risk Organization, Mission, and Information System View JOINT TASK FORCE TRANSFORMATION INITIATIVE INFORMATION SECURITY Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 March 2011 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Director Special Publication 800-39 Managing Information Security Risk Organization, Mission, and Information System View ________________________________________________________________________________________________ Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, g......

Words: 1680 - Pages: 7

Premium Essay

Jjjjjj

...Introduction to the Management of Information Security Chapter Overview The opening chapter establishes the foundation for understanding the field of Information Security. This is accomplished by explaining the importance of information technology and defining who is responsible for protecting an organization’s information assets. In this chapter the student will come to know and understand the definition and key characteristics of information security as well as the come to recognize the characteristics that differentiate information security management from general management. Chapter Objectives When you complete this chapter, you will be able to: • Recognize the importance of information technology and understand who is responsible for protecting an organization’s information assets • Know and understand the definition and key characteristics of information security • Know and understand the definition and key characteristics of leadership and management • Recognize the characteristics that differentiate information security management from general management INTRODUCTION Information technology is the vehicle that stores and transports information—a company’s most valuable resource—from one business unit to another. But what happens if the vehicle breaks down, even for a little while? As businesses have become more fluid, the concept of computer security has been replaced by the concept of information security. Because this new......

Words: 2580 - Pages: 11

Premium Essay

Kayworth and Whitten 2010 Misqe

...Effective Information Security Requires a Balance of Social and Technology Factors EffEctivE information SEcurity rEquirES MIS Uarterly a BalancE of Social and tEchnology xecutive factorS1,2 Q E Tim Kayworth Baylor University (U.S.) Dwayne Whitten Texas A&M University (U.S.) Executive Summary 2 Industry experts have called for organizations to be more strategic in their approach to information security, yet it has not been clear what such an approach looks like in practice or how firms actually achieve this. To address this issue, we interviewed 21 information security executives from 11 organizations. Our results suggest that a strategically focused information security strategy encompasses not only IT products and solutions but also organizational integration and social alignment mechanisms. Together, these form a framework for a socio-technical approach to information security that achieves three objectives: balancing the need to secure information assets against the need to enable the business, maintaining compliance, and ensuring cultural fit. The article describes these objectives and the security alignment mechanisms needed to achieve them and concludes with guidelines that can be applied to ensure effective information security management in different organizational settings. INFORMATION SECURITY HAS BECOME A STRATEGIC ISSUE Information security continues to be a major concern among corporate executives. The threat of terrorism,...

Words: 7959 - Pages: 32

Premium Essay

Information Security System

...Information Security Systems Shikhi Mehrotra Abstract -- The idea of information security has been there since the times of our ancestors/forefathers. In the 21st century we have carried that legacy forward from our forefathers and made unimaginable improvements in the information security systems. In this advanced era we have made sure that all the technologies are stretched beyond limit so that we, humans, have the best and the safest information security systems ever. In this paper each and every new technology will be put forth and analyzed so that these technologies can be advanced and used by our future generation. I. INTRODUCTION From old traditional lockers to advanced hardware and software’s security systems, the information security has reached an advanced level which was unimaginable in the past. The basic aim of such system is to protect information from any illegal/unauthorized use such as unauthorized access, unlawful modification, usage or recording, illegal copying or even data destruction. Even with the numerous advancements that have taken place, there is always the desire of continuously improve the Information Security systems and taken them to the next level. In the recent past, new advancements have been made in areas such as fingerprint recognition security systems and new hardware are being developed to compliment these systems so that a customer is provided with highest possible level of security system. Most of these systems find......

Words: 1395 - Pages: 6