Please enable JavaScript.

Coggle requires JavaScript to display documents.

Information Security (Security Incidents (2011: Stuxnet Iran (Employed…

- - - - Information system complexity
        
        Complex process
        Complex Structure
        Complex Application
      - Human and environment factors
        
        environmental threats
        man-made damages
- - - - Others
        
        ITU: International Telecom Union
        
        IETF: Internet Engineer Task Force
      - China
        
        China Info Sec Standardization Technical Committee
        
        TC8/CCSA: Cyber and info Sec Technical Committee of China Communication standards Association
      - International
        
        ISO: International Org for Standardization
        
        IEC: International Electrical Commission
    - - Graded Protection of InformationSecurity
        
        Refers to:
        
        Graded security protection of:
        
        Crucial government information
        
        Private and public information of legal persons/organizations/citizens
        
        Information Systems that store, transmit and process the information
        
        Graded management of information security products in information systems
        
        Graded response to and handling of information security incidents in information systems
        
        Developement
        
        04-06: Development Stage
        Many Protection-related Standards and Specs Formulated and Piloted
        
        07-Now: Promotion Stage
        Started Grading, Assessment, Rectification and review
        
        94-03: Initial State
        Chinese Gov Called for Strengthening of Information Security Construction
        
        Protected Objects
        
        Information System (Computer)
        
        IOT
        
        Cloud Computing Platform
        
        Industrial Control System
        
        Information System Using Mobile Internet Technologies
        
        Basic Information Network
        
        Big Data
        
        Grades
        Each Grade has its corresponding technical requirements
        Each Grade covers # of Aspects, that have control points and items
        
        I
        
        Damage to the legitimate rights and interests of citizens, legal persons and other organizations
        
        No damage to national security, social order or public interests
        
        II
        
        Severe Damage to the legitimate rights and interests of citizens, legal persons and other organizations
        
        Damage to social order or public interests
        
        No Damage to National Security
        
        III
        
        Severe Damage to social order or public interests
        
        Damage to National Security
        
        Has 5 Aspects: (Physical, App, Data, NW, Host) Security
        
        IV
        
        Severe Damage to social order or public interests
        
        Severe Damage to National Security
        
        V
        
        Severe Damage to National Security
        
        Process
        
        3- Assessment: Assess Security Protection
        
        4- Rectification: Implement the Graded Protection
        
        2- Filing: Notify the Supervision Department of Graded Protection Construction
        
        5- Supervision: External Management for the Graded Protection
        
        1- Grading
      - Europe - ITSEC: Information Technology Security Evaluation Criteria
        Formed by UK, France, Germany, Netherlands
        
        Functions Level: F1-F5, F6, F7, F8, F9, F10
        
        Evaluation Levels: E0, E1, E2, E3, E4, E5, E6
      - ISO
        
        ISO/IEC 27001
        
        Long Term Mechanism Based On BS7799-2 to establish ISMS "PDCA"
        
        27001 Stages "PDCA"
        
        3- System Design and Release
        
        4- Sys Ops and Monitor
        
        2- Risk Assessment
        
        5- Certification and Continuous Improvement
        
        1- Project Initiation and Variance Analysis
        
        ISO/IEC 27002
        
        Best Practice Rules For ISO 27001
        Code of Practice for info Sec Control
        
        35 Control Objectives & 113 Control across 14 Category/Control Areas
        1- Information Security Policies
        2- Org and Info Sec
        3- HR Sec
        4- Asset Management
        5- Access Control
        6- Cryptography
        7- Physical and Environmental Sec
        8- Operation Sec
        9- Communication Sec
        10- System Acquisition, Dev, Maintenance
        11- Supplier Relationship
        12- Info Sec incident Management
        13- Info Sec Aspects of business Continuity Management
        14- Compliance
      - US - TCSEC: Trusted Computer System Evaluation Criteria
        First Formal Standard for Computer System Security Evaluation
        Proposed by the Defense Science Board
        Released by the US department of Defense
        
        B: Mandatory Protection
        
        C: Discretionary Protection
        
        A: Verified Protection
        
        D: Minimal Protection
      - ISMS: Information Sec Management System
        
        Based on BS7799
        PDCA: Plan, Do, Check, Action
      - Sarbanes-Oxley Act
        
        Acts
        
        Strengthening auditor independence
        
        Increasing the corporate responsibility for financial reports
        
        Enhancing financial disclosures
        
        Increasing criminal penalties
        
        Setting up the Public Company Accounting Oversight Board (PCAOB) to supervise registered public accounting firms
        
        Impact
        
        Responsibilities of board members: The board members and audit commission must undertake self-assessment and follow-up education.
        
        Professional ethics and corporate law-abiding: The act requires companies to develop written provisions on employees' professional ethics and the audit committee to establish an internal report incentive mechanism
        
        Transparency and information disclosure: The Securities & Exchange Commission recommended the establishment of the Information Disclosure Committee to strengthen the responsibilities of internal audit departments.
        
        Risk management and control: Establish an internal control system and process
      - BS7799
        
        Developed By "BSI" British Standards Institution
- - - - OS Vulnerability (Injection, XSS, Malware, Data Breach)
        
        Virus
        
        Trojan Horse
        
        Worm
        
        Backdoor
        
        Spyware
      - Phishing websites
      - Data Breaches
    - - Improving Information Security Awareness:
        Constantly looking out for suspicious Websites and links
      - Protection through Professional Equipment:
        FW, WAF, Antivirus
      - Regular Vulnerability Fixing:
        Vulnerability Scanning
        Patching
- - - - Security As a Service
      - Endpoint Detection increasingly important
      - Traffic Control (Layer 4 Quintuple) (Layer 7 Application)
      - SD-Security protection Solutions