Premium Essay

Information Security and Technology

In: Computers and Technology

Submitted By vx8550
Words 422
Pages 2
1. What is the difference between a threat agent and a threat?
A threat agent is a specific instance or a component of a threat. A threat is a category of objects, persons, or other entities that presents a danger to an asset. 2. What is the difference between vulnerability and exposure?
Vulnerability is a weakness or fault in a system or protection mechanism that opens it to attack or damage. Exposure is the condition or state of being exposed. 3. What are the three components of the CIA triangle? What are they used for?
The three components of the CIA triangle are confidentiality, integrity, and availability. Confidentiality is used to protect information from disclosure or exposure to unauthorized individuals or systems. Integrity is when information is a whole, complete, and uncorrupted. Availability is used to enable authorized users to access information without interference and to receive it in the required format. 4. Describe the critical characteristics of information. How are they used in the study of computer security?
The critical characteristics of information is the value of information it possesses. If a characteristic change, the value of information also changes. There are seven critical characteristics which are:
Availability - enable authorized users to access information without interference or obstruction and receives it in the required format.
Accuracy - information that is free from errors and it has the value that the end user expects
Authenticity - quality or state of being genuine or original, not a reproduction or fabrication. Information is authentic when it is in the same state in which it was created, placed, stored, or transferred.
Confidentiality - information that is protected from disclosure or exposure to unauthorized individuals or systems. It ensures that only those with the rights and privileges to access…...

Similar Documents

Premium Essay

Information Security

...The Importance of Information Systems Security Mario M. Brooks Webster University SECR 5080 – Information Systems Security November 17, 2012 Abstract Information System Security is critical to the protection of vital information against unauthorized disclosure for legal and competitive reasons. All critical information must be protected against accidental and deliberate modification. The establishment and maintenance of documents that have been created, sent, and received will be the cornerstone of all financial establishments in modern society. Poor security practices and weak security policies lead to damages to systems. Criminal or civil proceedings can be the result if the perpetuators are caught and if third parties are harmed via those compromised systems. In this paper, Information System will be defined. The paper will also discuss the lapses, vulnerabilities, and the various ways of improving the system. It is very important that the make-up of Information Systems Security and their capabilities are understood. Information Systems can be a combination of information technology and the people that support operations, management, and decision-making. Information Security, is the protection of information and information systems from unauthorized access, disclosure, use, disruption, modification, inspection, recording, or destruction. The terms Information Security, Computer Security, and Information Assurance are frequently used......

Words: 1133 - Pages: 5

Premium Essay

Information Security

...Computer Security Anyone would agree that private information needs to remain private. To keep any information secured takes a lot of time and effort. In order to make sure the information will be kept private the information itself has to satisfy certain properties in order to make sure the information is kept secured. “Confidentiality, integrity and availability have been considered the three core principles of information security for more than two decades. They are commonly referred to as the CIA triad” (Cyber Secure Online, 2013). When designing security controls you will definitely be addressing one or more of these core principles. Even though these principles were considered core security professionals realized that the focus cannot solely be on these three principles alone. The CIA triad was expanded by adding an additional four principles that have enhanced and would now have a more sufficient in protecting confidential information. Listed here are the seven principles of the Expanded CIA triad: Confidentiality, Integrity, Availability, Possession, Authenticity, Utility, and Accuracy. As stated above many of the security professionals did not want all concentration to be on the original three, so it made sense to expand. This will ensure that the information that needs to be protected is protected thoroughly. “Each time an information technology team installs a software application or computer server, analyzes an data transport method, creates a......

Words: 453 - Pages: 2

Free Essay

Information Security

...IT SECURITY All of new technologies of the modern age have changed the way the human race commutates with other human beings. Also, this feat has made the way business is conducted today very convent and easier to do. The Internet is a huge discover for mankind for the commutation barrier. With all of these new products like smartphones, tablets, and computers made this new capability for anyone in the world that can afford at least one of these products. Since this new commutation barrier is being used daily by the human race, this very much-changed the “business world”. Databases of your personal information, such as credit card numbers, social security numbers, and even your address are on the Internet somewhere. IT has proved to be a significant employer. Many people with knowledge of computers have got jobs in this field, and have successfully made a career out of it. Since it has changed the business world in such a dramatic way, Corporations need employees that have the skill to protect this values and private information. Information technology has helped one find cures for several diseases; thereby, serving mankind in plentiful ways. Many other programs have helped individuals that have visual or hearing impairment. Corporations use information in databases to run operating activities day to day. In the world we live in today information technology is only becoming more and integrated in our daily lives, as we know it. To the......

Words: 1443 - Pages: 6

Premium Essay

Information Security Technologies

...Research Paper: Information Security Technologies by Benjamin Tomhave November 10, 2004 Prepared for: Professor Dave Carothers EMSE 218 The George Washington University This paper or presentation is my own work. Any assistance I received in its preparation is acknowledged within the paper or presentation, in accordance with academic practice. If I used data, ideas, words, diagrams, pictures, or other information from any source, I have cited the sources fully and completely in footnotes and bibliography entries. This includes sources which I have quoted or paraphrased. Furthermore, I certify that this paper or presentation was prepared by me specifically for this class and has not been submitted, in whole or in part, to any other class in this University or elsewhere, or used for any purpose other than satisfying the requirements of this class, except that I am allowed to submit the paper or presentation to a professional publication, peer reviewed journal, or professional conference. In adding my name following the word 'Signature', I intend that this certification will have the same authority and authenticity as a document executed with my hand-written signature. Signature _____Benjamin L. Tomhave________________________ Benjamin L. Tomhave 12/7/2004 1 Research Paper: Information Security Technologies by Benjamin L. Tomhave Abstract The following research paper provides analysis of thirteen (13) information security technology topics, arranged in ten......

Words: 12903 - Pages: 52

Premium Essay

Information Security

...production from the worm outbreak last month, and they directed us to improve the security of our technology. Gladys says you can help me understand what we need to do about it.” “To start with,” Charlie said, “instead of setting up a computer security solution, we need to develop an information security program. We need a thorough review of our policies and practices, and we need to establish an ongoing risk management program. There are some other things that are part of the process as well, but these would be a good start.” “Sounds expensive,” said Fred. Charlie looked at Gladys, then answered, “Well, there will be some extra expenses for specific controls and software tools, and we may have to slow down our product development projects a bit, but the program will be more of a change in our attitude about security than a spending spree. I don’t have accurate estimates yet, but you can be sure we’ll put cost-benefit worksheets in front of you before we spend any money.” Fred thought about this for a few seconds. “OK. What’s our next step?” Gladys answered, “First, we need to initiate a project plan to develop our new information security program. We’ll use our usual systems development and project management approach. There are a few differences, but we can easily adapt our current models. We’ll need to appoint or hire a person to be responsible for information security.” The Need for Security Our bad neighbor makes us early stirrers, Which is both healthful and good......

Words: 24411 - Pages: 98

Premium Essay

Information Security

...Information security, sometimes shortened to InfoSec, is the practice of defending information from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. It is a general term that can be used regardless of the form the data may take (electronic, physical, etc...)[1] Two major aspects of information security are: • IT security: Sometimes referred to as computer security, Information Technology Security is information security applied to technology (most often some form of computer system). It is worthwhile to note that a computer does not necessarily mean a home desktop. A computer is any device with a processor and some memory (even a calculator). IT security specialists are almost always found in any major enterprise/establishment due to the nature and value of the data within larger businesses. They are responsible for keeping all of the technology within the company secure from malicious cyber attacks that often attempt to breach into critical private information or gain control of the internal systems. • Information assurance: The act of ensuring that data is not lost when critical issues arise. These issues include but are not limited to: natural disasters, computer/server malfunction, physical theft, or any other instance where data has the potential of being lost. Since most information is stored on computers in our modern era, information assurance is typically dealt with by IT security specialists. One......

Words: 768 - Pages: 4

Premium Essay

Information Security

...Information Security August 10, 2012 One of the biggest issues in the Information Technology field these days is information security. Today almost anything can be found on the internet. Even like how to videos on how to put in a window, break-into a house, or even hack computers. The digital age has many perks but it also has many down falls to it as well. The perks that we enjoy so much from the internet also leaves us open to identity theft and company information theft. This gives Information Technology professionals a lot to think about when they consider Information Technology. One of the biggest threats facing the IT industries today is the end users non-malicious security violations that leave companies vulnerable to attack. In a recent Computer Security Institute survey, 41 percent of the participating U.S organizations reported security incidents. (Guo, 2012 p. 203-236) Also according to the same survey it was found that 14 percent of the respondents stated that nearly all of their company’s loses and or breaches were do to non-malicious and or careless behavior by the end users. (Guo, 2012 p. 203-236) Some of the end users behaviors that help these threats along were the peer-to-peer file-sharing software installed by the end user that might compromise company computers. Some other examples of security being compromised by end users would be people that use sticky notes to write there passwords down and leave them where other people can see......

Words: 1422 - Pages: 6

Premium Essay

Information Technology/Network Security Threats

...password, policy, to educate the users. SECURITY CONSIDERATIONS IN THE INFORMATION SYSTEM DEVELOPMENT LIFE CYCLE. Each information security environments unique, unless modified to adapt to meet the organization’s needs. The System Development Life Cycle (SDLC) the system development life cycle starts with the initiation of the system planning process, and continues through system acquisition and development, implementation, operations and maintenance, and ends with disposition of the system. Service decisions about security made in each of these phases to assure that the system is secure. The initiation phase begins with a determination of need for the system. The organization develops its initial definition of the problem that solved through automation. This followed by a preliminary concept for the basic system that needed, a preliminary definition of requirements, and feasibility and technology assessments. Also during this early phase, the organization starts to define the security requirements for the planned system. Management approval of decisions reached is important at this stage. The information developed in these early analyses used to estimate the costs for the entire life cycle of the system, including information system security. An investment analysis determine the appropriate strategy for achieving the system requirements, while taking mission needs and budget constraints into account. Expenditures for security before the system built. It......

Words: 1444 - Pages: 6

Premium Essay

Information Security

...Assessment Information Management Dovile Vebraite B00044098 Department of Business School of Business & Humanities Institute of Technology, Blanchardstown Dublin 15. Higher Certificate of Business Information Management 20/08/2014 Contents What is Information Security? ........................................................................ 3 What are the Goals of Information Systems Security? ….……………………………. 4 How big is the Security Problem? ………………………………………………………………. 5 Information Security Threats ……………………………………………………………………… 6 How to Secure the Information Systems? ………………………………………………….. 7 Conclusion …………………………………………………………………………………………………. 8 Bibliography ………………………………………………………………………………………………. 9 What is information security? ‘’Information security, to protect the confidentiality, integrity and availability of information assets, whether in storage, processing or transmission. It is achieved via the application of policy, education, training and awareness, and technology.’’ (Whitman, Mattord, 2011). Information security is the protection of information and information systems from unauthorised access, modification, disruption, destruction, disclosure, or use. In other words it handles the risk management. The definition of information security is based on the concept that if there is a loss of CIA (confidentiality, integrity and availability) of information, then the person or business will suffer harm. What are the goals of......

Words: 1543 - Pages: 7

Premium Essay

Information Security

...Principles of Information Security, Fourth Edition Chapter 3 Legal, Ethical, and Professional Issues in Information Security Learning Objectives • Upon completion of this material, you should be able to: – Describe the functions of and relationships among laws, regulations, and professional organizations in information security – Differentiate between laws and ethics – Identify major national laws that affect the practice of information security – Explain the role of culture as it applies to ethics in information security Principles of Information Security, 4th Edition 2 Introduction • You must understand scope of an organization’s legal and ethical responsibilities • To minimize liabilities/reduce risks, the information security practitioner must: – Understand current legal environment – Stay current with laws and regulations – Watch for new issues that emerge Principles of Information Security, 4th Edition 3 Law and Ethics in Information Security • Laws: rules that mandate or prohibit certain societal behavior • Ethics: define socially acceptable behavior • Cultural mores: fixed moral attitudes or customs of a particular group; ethics based on these • Laws carry sanctions of a governing authority; ethics do not Principles of Information Security, 4th Edition 4 Organizational Liability and the Need for Counsel • Liability: legal obligation of an entity extending beyond criminal or contract law; includes legal obligation to make restitution...

Words: 2389 - Pages: 10

Premium Essay

Information Security

...Security Issues in Legal Context Discussion 5.1: Privacy in the Workplace The Children's Online Privacy Protection Act, which went into effect date, April 21, 2000, affects U. S. commercial Web sites and third-party commercial Web sites that schools permit their students to access. "COPPA requires "operators of websites or online services directed to children and operators of websites or online services who have actual knowledge that the person from whom they seek information is a child (1) To post prominent links on their websites to a notice of how they collect, use, and/or disclose personal information from children; (2) With certain exceptions, to notify parents that they wish to collect information from their children and obtain parental consent prior to collecting, using, and/or disclosing such information; (3) Not to condition a child's participation in online activities on the provision of more personal information than is reasonably necessary to participate in the activity; (4) To allow parents the opportunity to review and/or have their children's information deleted from the operator’s database and to prohibit further collection from the child; and (5) To establish procedures to protect the confidentiality, security, and integrity of personal information they collect from children. Non-profit sites are not included in the act; however, many are voluntarily complying. The Children's Internet Protection Act went into effect April 20,......

Words: 2799 - Pages: 12

Premium Essay

Information Security

...Human differences Human beings are prone to certain characteristics that tend to affect their relation to information security. Information security refers to the ability of an individual to ensure that information is free from any kind of access by unwarranted individuals. There are several human inadequacies that affect the level of information security. However, this discussion is going to concentrate on three major human characteristics that affect information security. These include: acts of omission, acts of commission and acts of sequence. These three acts are important in to information security because they are not related to distortion of information but they increase the challenges in regard to making information secure. Information security involves the ability of an individual to access certain preserved information with ease. Information security does not involve distortion of information. These reasons make these three acts to be a concern to stakeholders within the information security sector. These three acts have distinct influence on the level of security in regard to information. Parsons et.al (2010) argues that acts of omission involve the inability to execute important activities when dealing with information. There are certain requirements in the field of information that require constant activities. For example, it is recommended that one should change his passwords regularly to reduce cases of illegal access by unwarranted individuals (Parsons et.al...

Words: 974 - Pages: 4

Premium Essay

Information Security

...implementing the information security management standards, plus potential metrics for measuring and reporting the status of information security, both referenced against the ISO/IEC standards. Scope This guidance covers all 39 control objectives listed in sections 5 through 15 of ISO/IEC 27002 plus, for completeness, the preceding section 4 on risk assessment and treatment.  Purpose This document is meant to help others who are implementing or planning to implement the ISO/IEC information security management standards.  Like the ISO/IEC standards, it is generic and needs to be tailored to your specific requirements. Copyright This work is copyright © 2010, ISO27k Forum, some rights reserved.  It is licensed under the Creative Commons Attribution-Noncommercial-Share Alike 3.0 License.  You are welcome to reproduce, circulate, use and create derivative works from this provided that (a) it is not sold or incorporated into a commercial product, (b) it is properly attributed to the ISO27k Forum at www.ISO27001security.com, and (c) derivative works are shared under the same terms as this. Ref. | Subject | Implementation tips | Potential metrics | 4. Risk assessment and treatment | 4.1 | Assessing security risks | Can use any information security risk management method, with a preference for documented, structured and generally accepted methods such as OCTAVE, MEHARI, ISO TR 13335 or BS 7799 Part 3. See ISO/IEC 27005 for general advice. | Information security risk......

Words: 4537 - Pages: 19

Premium Essay

Security and Technology

...Information regarding health information of patients and citizens is supposed to be very private and putting it into a nationwide database makes it liable to access by people who are not supposed to see it. The growing demand for information technology (IT) in health sector means that a lot of policies have to be drafted and enacted in order to protect the privacy of patients (Andrew, & Richard, 1995). Generally, there are privacy and security concerns that arise and which can be divided into two general categories. The first concerns are about the release of such sensitive information by institutions that are supposed to handle the data while the second concern is related to how information is handled within the healthcare system and its allied industries (National Research Council, 1997). Any information that is stored electronically is vulnerable to abuse by either internal or external people who may violate the confidentiality policy of those organizations by accessing data that is not supposed to be accessed. By the virtue of one being a worker in a health organization, he or she can abuse the privilege of being able to access different records. This comes about by accessing information for inappropriate reasons like viewing records of friends, neighbors, coworkers or even family members and then leaking the information out of the organization (Hossein, 2006). This internal accessing of data may sometimes lead to manipulation of data but at most time people just snoop...

Words: 679 - Pages: 3

Premium Essay

Information Security

...Attack On Government Computers Computer Security Attack on Government Computers The emergence of computers has augmented information storage in various sectors. Information System (IS) refers to an assembly of computers that aids to collate, stockpile, process, and commune information. The government is one of the principal entities that utilize IS to ensure safety of the country’s information. However, the storage systems normally face attacks by some outer entities. The aim of such hackings ranges from access to confidential information to attacks. Some of the remarkable attackers encompass rival states, revolutionaries, criminals, as well as illegal insiders (Rainer Jr & Cegielski, 2009)The software and information engineers have the required expertise to safeguard the systems thus evading and countering the attacks. The US government has faced myriads of attacks, especially the security information. It is imperative to assert that the notable attacks arise from the terrorists who target the government and other critical points within US. Records show that cyber attacks on federal computer networks increased 40 percent last year, and that figure is likely low as it reflects only the reported attacks. Based on data provided to USA Today by US-CERT, unauthorized access to government computers and installations of hostile programs rose from a combined 3,928 incidents in 2007 to 5,488 in 2008. (Government, 2008) According to Brad Curran, Frost &......

Words: 540 - Pages: 3