Chapter 3. Information Security Framework

Our focus in this chapter on information security objectives and framework will answer the following (and many other) questions associated with the need to maintain secure communications among and between government, public, and private sectors. In context, our efforts to sustain reliable and secure communications has become a worldwide global effort with cybersecurity.

What are we trying to achieve in pursuit of information security?

What is the ultimate goal of writing information security policies?

What tangible benefit will come to our customers, our employees, our partners, and our organizations from our Herculean effort?

A framework lends itself to many easily related metaphors. The most obvious is that of any building: no foundation, no building. More specifically, the better the framing of any building, the longer it will last, the more it can hold, and the more functional it becomes. Of course, with any building there must first be a plan. We hire architects and engineers to design our buildings, to think about what is possible, and relay the best way to achieve those possibilities.

In the same way, we need a framework for our information security program. Much like the many rooms in a building, each with its own functions, we segment our information security program into logical and tangible units called domains. Security domains are associated with designated groupings of related activities, systems, or resources. For example, the Human Resources Security Management domain includes topics related to personnel, such as background checks, confidentiality agreements, and employee training. Without the framework, every new situation will see us repeating, redesigning, and reacting, which all together can be referred to as “unplanned,” or spending time in crisis. Fortunately, in the information security arena there is absolutely no reason to choose crisis over preparedness. Strategies involving proactive, rather than reactive, procedures have become the ad hoc standard for systems of cybersecurity governance. A number of public and private organizations, including the International Organization for Standardization (ISO) and the National Institute of Standards and Technology (NIST), have all invested considerable time and energy to develop structures that we can draw upon.

In this chapter, you are going to be introduced to both. Before we begin building our information security program and policies, we need to first identify what we are trying to achieve and why. We will begin this chapter by discussing the three basic tenants of information security. We will then look at the escalating global threat, including who is behind the attacks, their motivation, and how they attack. We will apply this knowledge to building the framework of our information security program and how we write our policies.

(1) The term “information security” means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation, accuracy, and authenticity;

(B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(C) availability, which means ensuring timely and reliable access to and use of information.

You may be wondering which is most important: confidentiality, integrity, or availability? The answer requires an organization to assess its mission, evaluate its services, and consider regulations and contractual agreements. As Figure 3.1 illustrates, organizations may consider all three components of the CIA triad equally important, in which case resources must be allocated proportionately.

The information exchanged between doctors and patients or lawyers and clients is protected by confidentiality laws called the “doctor-patient privilege” and the “attorney-client privilege,” respectively. We place a very high value on this quality in people and express it in many ways, referring to those who keep our confidences as trustworthy, dependable, or loyal. The confidentiality of information is certainly not a new idea, so what is all the fuss about?

Not only has the amount of information stored, processed, and transmitted on privately owned networks and the public Internet increased dramatically, so has the number of ways to potentially access the data. The Internet, its inherent weaknesses, and those willing (and able) to exploit vulnerabilities are the main reasons why protecting confidentiality has taken on a new urgency. The technology and accessibility we take for granted would have been considered magic just ten years ago. The amazing speed at which we arrived here is also the reason we have such a gap in security. The race to market often means that security is sacrificed. So although it may seem to some that information security requirements are a bit extreme at times, it is really a reaction to the threat environment.

As it pertains to information security, confidentiality is the protection of information from unauthorized people and processes. Federal Code 44 U.S.C., Sec. 3542 defines confidentiality as “preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information.”

None of us likes the thought of our private health information or financial information falling into some stranger’s hands. No business owner likes the thought of her proprietary business information being disclosed to competitors. Information is valuable. Social security numbers are used for identity theft. Bank account credentials are used to steal money. Medical insurance information can be used to fraudulently obtain services or to make counterfeit claims. Military secrets can be used to build weaponry, track troop movements, or expose counterintelligence agents. The list goes on and on.

Cybercrime is a relatively easy, low-risk, high-reward venture. There is plenty of money to be made. The chances of being caught are slim. The tools are readily available. Criminals look for and are prepared to exploit weaknesses in network designs, software, communication channels, and people. The opportunities are plentiful. Criminals are not always outsiders. Insiders can be tempted to “make copies” of information they have access to for financial gain, notoriety, or to “make a statement.” The most recent threat to confidentiality is hacktivism, which is a combination of the terms “hack” and “activism.” Hacktivism has been described as the fusion of hacking and activism, politics and technology. Hackitivist groups or collectives expose or hold hostage illegally obtained information to make a political statement or for revenge.

The ability to obtain unauthorized access is often opportunistic. In this context, opportunistic means taking advantage of identified weaknesses. Criminals (and nosy employees) care about the work factor, which is defined as how much effort is needed to complete a task. The longer it takes to obtain unauthorized access, the greater the chance of being caught. The more a “job” costs to successfully complete, the less profit earned. The information security goal of confidentiality is to protect information from unauthorized access and misuse. The best way to do this is to implement safeguards and processes that increase the work factor and the chance of being caught. This calls for a spectrum of access controls and protections as well as ongoing monitoring, testing, and training.

Data integrity is a requirement that information and programs are changed only in a specified and authorized manner. In other words, is the information the same as it was intended to be? For example, if you save a file with important information that must be relayed to members of your organization, but someone opens the file and changes some or all of the information, the file has lost its integrity. The consequences could be anything from coworkers missing a meeting you planned for a specific date and time, to 50,000 machine parts being produced with the wrong dimensions.

System integrity is a requirement that a system “performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system.” A computer virus that corrupts some of the system files required to “boot” the computer is an example of deliberate unauthorized manipulation.

Errors and omissions are an important threat to data and system integrity. These errors are caused not only by data entry clerks processing hundreds of transactions per day, but also by all types of users who create and edit data and code. Even the most sophisticated programs cannot detect all types of input errors or omissions. In some cases, the error is the threat, such as a data entry error or a programming error that crashes a system. In other cases, the errors create vulnerabilities. Programming and development errors, often called “bugs,” can range in severity from benign to catastrophic.

To make this a bit more personal, let’s talk about medical and financial information. What if you are injured, unconscious, and taken to the emergency room of a hospital, and the doctors need to look up your health information. You would want it to be correct, wouldn’t you? Consider what might happen if you had an allergy to some very common treatment and this critical information had been deleted from your medical records. Or think of your dismay if you check your bank balance after making a deposit and find that the funds have not been credited to your account!

Integrity and confidentiality are interrelated. If a user password is disclosed to the wrong person, that person could in turn manipulate, delete, or destroy data after gaining access to the system with the password he obtained. Many of the same vulnerabilities that threaten integrity also threaten confidentiality. Most notable, though, is human error. Safeguards that protect against the loss of integrity include access controls such as encryption and digital signatures, process controls such as code testing, monitoring controls such as file integrity monitoring and log analysis, and behavioral controls such as separation of duties, rotation of duties, and training.

We must broaden our understanding of what information security means in several ways. For one (which was demonstrated earlier), information security is not just about computers—it is about information. For another, security does not pertain only to crime, malicious acts, or those who perpetrate them. It also pertains to feeling secure that the information can be used when needed, in the way needed.

In fact, availability is generally one of the first security issues addressed by Internet service providers (ISPs). You may have heard the expressions “uptime” and “5-9s” (99.999% uptime). This means the systems that serve Internet connections, web pages, and other such services will be available to users who need them when they need them. The service level agreement (SLA) is a type of agreement between a service provider and a customer that specifically addresses availability of services.

Just like confidentiality and integrity, we prize availability. We want our friends and family to “be there when we need them,” we want food and drink available, we want our money available, and so forth. In some cases, our lives depend on the availability of these things, including information. Ask yourself how you would feel if you needed immediate medical care and your physician could not access your medical records.

Threats to availability include loss of processing ability due to natural disasters; hardware failures; programming errors; human error; injury, sickness, or death of key personnel; distributed denial of service (DDoS) attacks; and malicious code. We are more vulnerable to availability threats than to the other components of the CIA triad. We are certain to face some of them. Safeguards that address availability include access controls, monitoring, data redundancy, resilient systems, virtualization, server clustering, environmental controls, continuity of operations planning, and incident response preparedness.

As illustrated in Figure 3.2, a DDoS attack is one in which a multitude of compromised systems attack a single target. The flood of incoming requests to the target system essentially forces it to shut down, thereby denying service to legitimate users. There are multiple victims in a DDoS attack: the owners of the targeted systems, the users of the targeted system, and the owners of the compromised computers. A computer used in the attack is known as a bot. A group of co-opted computers is known as a botnet. Although the owners of co-opted computers are typically unaware that their computers have been compromised, they are nevertheless likely to suffer degradation of service and malfunction.

Information technology (IT) or information systems (IS) departments are widely perceived as owning the information and information systems. Perhaps this is due to the word “information” being part of the department title. For the record, with the exception of information specific to their department, IT and IS departments should not be considered information owners. Rather, they are the people charged with maintaining the systems that store, process, and transmit the information. They are known as information custodians—those responsible for implementing, maintaining, and monitoring safeguards and systems. They are better known as system administrators, webmasters, and network engineers. We will be taking a closer look at each of these roles in the next chapter.

By raising awareness of IT risks, vulnerabilities, and protection requirements, particularly for new and emerging technologies.

By researching, studying, and advising agencies of IT vulnerabilities and devising techniques for the cost-effective security and privacy of sensitive federal systems.

By developing standards, metrics, tests, and validation programs

to promote, measure, and validate security in systems and services, and

to educate consumers and to establish minimum security requirements for federal systems.

By developing guidance to increase secure IT planning, implementation, management, and operation.

The 2002 E-Government Act [Public Law 107-347] assigned the NIST the mission of developing an Information Assurance Framework (standards and guidelines) designed for federal information systems that are not designated as national security systems. The NIST Information Assurance Framework includes the Federal Information Processing Standards (FIPS) and Special Publications (SP). Although developed for government use, the framework is applicable to the private sector and addresses the management, operational, and technical aspects of protecting the CIA of information and information systems.

NIST defines information security as the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide CIA. Currently, there are more than 300 NIST information security–related documents. This number includes FIPS, the SP 800 series, information, Information Technology Laboratory (ITL) bulletins, and NIST interagency reports (NIST IR):

Federal Information Processing Standards (FIPS)—This is the official publication series for standards and guidelines adopted and promulgated under the provisions of the FISMA Act of 2002.

Special Publication (SP) 800 series—This series reports on ITL research, guidelines, and outreach efforts in information system security and its collaborative activities with industry, government, and academic organizations.

ITL bulletins—Each bulletin presents an in-depth discussion of a single topic of significant interest to the information systems community. Bulletins are issued on an as-needed basis.

From access controls to wireless security, the NIST publications are truly a treasure trove of valuable and practical guidance.

ISO is a nongovernmental organization: Unlike the United Nations, its members are not delegations of national governments. Nevertheless, ISO occupies a special position between the public and private sectors. This is because, on the one hand, many of its member institutes are part of the governmental structure of their countries, or are mandated by their government. On the other hand, other members have their roots uniquely in the private sector, having been set up by national partnerships of industry associations. ISO has developed more than 13,000 International Standards on a variety of subjects, ranging from country codes to passenger safety.

The ISO/IEC 27000 series (also known as the ISMS Family of Standards, or ISO27k for short) comprises information security standards published jointly by the ISO and the International Electrotechnical Commission (IEC).

The first six documents in the ISO/IEC 27000 series provide recommendations for “establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an Information Security Management System.” In all, there are 22 documents in the series, and several more are still under development.

ISO 27001 is the specification for an Information Security Management System (ISMS).

ISO 27002 describes the Code of Practice for information security management.

ISO 27003 provides details implementation guidance.

ISO 27004 outlines how an organization can monitor and measure security using metrics.

ISO 27005 defines the high-level risk management approach recommended by ISO.

ISO 27006 outlines the requirements for organizations that will measure ISO 27000 compliance for certification.

The framework is applicable to public and private organizations of all sizes. According to the ISO website, “the ISO standard gives recommendations for information security management for use by those who are responsible for initiating, implementing or maintaining security in their organization. It is intended to provide a common basis for developing organizational security standards and effective security management practice and to provide confidence in inter-organizational dealings.”

We are going to focus on the ISO 27002 Code of Practice. ISO 27002 has its origins in Great Britain. In 1989, the UK Department of Trade and Industry’s (DTI’s) Commercial Computer Security Centre (CCSC) developed the “Users Code of Practice,” designed to help computer users employ sound security practices and ensure the CIA of information systems. Further development came from the National Computing Centre (NCC), and later a group formed from British industry, to ensure that the Code was applicable and practical from a user’s point of view. The document was originally published as British Standards guidance document PD 0003: A Code of Practice for Information Security Management. After more input was received from private sector organizations, the document was reintroduced as British Standard BS7799:1995. After two revisions in 1997 and 1999, BS7799 was proposed as an ISO standard. Though the first revisions were defeated, it was eventually adopted by the ISO after an international ballot closed in August 2000 and published with minor amendments as ISO/IEC 17799:2000 on December 1, 2000. A new version, ISO 17799:2005, was published in 2005. In 2007, this version was renamed as 27002:2005 and incorporated into the 27000 series. The most significant difference between the 17799 series and the 27000 series is an optional certification process. Organizations ISMS may be certified compliant with ISO/IEC 27001 by a number of Accredited Registrars worldwide.

In October 2013, ISO 27002:2005 was replaced with ISO 27002:2013. Two categories were added: Cryptography and Supplier Relationships. The Operations and Communications domain was split into two separate categories. Most importantly, a decision was made to remove the risk assessment guidance because it was a subset of ISO 27005, which specifically addresses information security risk management, including risk assessment, risk treatment, risk acceptance, risk communication, risk monitoring, and risk review. More information about the ISO can be found at www.iso.org.

Information Security Policies

Organization of Information Security

Human Resources Security

Asset Management

Access Control

Cryptography

Physical and Environmental Security

Operations Security

Communications Security

Systems Acquisition, Development, and Maintenance

Supplier Relationships

Information Security Incident Management

Business Continuity Management

Compliance Management

We will be using both the ISO 27002:2013 Code of Practice and the NIST guidance as a framework for developing procedures and policies. Using this framework will allow us to organize our approach to developing policies; it provides a structure for development and a method of grouping similar policies. The first step is to become familiar with the goals and intent of each of the security domains (or categories). In subsequent chapters, we examine each domain in depth, evaluate security practices, and develop policy.

The corresponding NIST Special Publications are as follows:

SP 800-12: An Introduction to Computer Security: The NIST Handbook

SP 800-100: Information Security Handbook: A Guide for Managers

The corresponding NIST Special Publications are as follows:

SP 800-12: An Introduction to Computer Security: The NIST Handbook

SP 800-14: Generally Accepted Principles and Practices for Securing Information Technology Systems

SP 800-100: Information Security Handbook: A Guide for Managers

The corresponding NIST Special Publications are as follows:

SP 800-12: An Introduction to Computer Security—The NIST Handbook

SP 800-16: Information Technology Security Training Requirements: A Role- and Performance-Based Model

SP 800-50: Building an Information Technology Security Awareness and Training Program

SP 800-100: Information Security Handbook: A Guide for Managers

The corresponding NIST Special Publications are as follows:

SP 800-60: Guide for Mapping Types of Information and Information Systems to Security Categories (two volumes)

SP 800-88: Guidelines for Media Sanitization

The corresponding NIST Special Publications are as follows:

SP 800-41, R1: Guidelines on Firewalls and Firewall Policy

SP 800-46, R1: Guide to Enterprise Telework and Remote Access Security

SP 800-63: Electronic Authentication Guidance

SP 800-77: Guide to IPsec VPNs

SP 800-113: Guide to SSL VPNs

SP 880-114: User’s Guide to Securing External Devices for Telework and Remote Access

SP 800-153: Guidelines for Securing Wireless Local Area Networks (WLANs)

The corresponding NIST Special Publications are as follows:

800-57: Recommendations for Key Management—Part 1: General (Revision 3)

800-57: Recommendations for Key Management—Part 2: Best Practices for Key Management Organization

800-57: Recommendations for Key Management—Part 3: Application-Specific Key Management Guidance

800-64: Security Considerations in the System Development Life Cycle

800-111: Guide to Storage Encryption Technologies for End User Devices

The corresponding NIST Special Publications are as follows:

SP 800-12: An Introduction to Computer Security—The NIST Handbook

SP 800-14: Generally Accepted Principles and Practices for Securing Information Technology Systems

SP 800-88: Guidelines for Media Sanitization

SP 800-100: Information Security Handbook: A Guide for Managers

The corresponding NIST Special Publications are as follows:

SP 800-40: Creating a Patch and Vulnerability Management Program

SP 800-42: Guideline on Network Security Testing

SP 800-83: Guide to Malware Incident Prevention and Handling for Desktops and Laptops

SP 800-92: Guide to Computer Security Log Management

SP 800-100: Information Security Handbook: A Guide for Managers

The corresponding NIST Special Publications are as follows:

SP 800-45: Guidelines on Electronic Mail Security

SP 800-92: Guide to Computer Security Log Management

SP 800-14: Generally Accepted Principles and Practices for Securing Information Technology Systems

Here’s the corresponding NIST Special Publication:

SP 800-23: Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products

There is no corresponding NIST Special Publication.

The corresponding NIST Special Publications are as follows:

SP 800-61: Computer Security Incident Handling Guide

SP 800-83: Guide to Malware Incident Prevention and Handling

SP 800-86: Guide to Integrating Forensic Techniques into Incident Response

The corresponding NIST Special Publications are as follows:

SP 800-34: Contingency Planning Guide for Information Technology System, Revision 1

SP 800-84: Guide to Test, Training and Exercise Programs for Information Technology Plans and Capabilities

The corresponding NIST Special Publications are as follows:

SP 800-60: Guide for Mapping Types of Information and Information Systems to Security

SP Categories: Volume 1: Guide, Volume 2: Appendices

SP 800-66: An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

Section 4.1 of the 27002:2013 Code of Practice document informs us that the order of the domains does not imply their importance, nor are they listed in priority order. As such, this book takes the liberty of reordering the sections and, where applicable, combining domains. Starting with Chapter 4 and continuing through Chapter 12, we map the security objectives of each domain to realistic, relevant, and usable practices and policies. We define goals and objectives, explore in detail relevant security issues, and discuss the applicability of the standard.

An information owner is one who has been assigned the authority and responsibility for ensuring that information and related systems are protected from creation through destruction. This includes making decisions on information classification, safeguards, and controls. Information custodians are those responsible for implementing, maintaining, and monitoring the safeguards based on decisions made by information owners. Cohesive decision making requires a framework.

A security framework is a collective term given to guidance on topics related to information systems security, predominantly regarding the planning, implementing, managing, and auditing of overall information security practices. The International Organization for Standardization (ISO) has published a technology-neutral Code of Standards for Information Security known as the ISO/IEC 27002:2013. This standard has been internationally adopted by both private and public organizations of all sizes. ISO 27002:2013 is divided into 14 domains. Each of these categories has a control objective, compliance requirements, and recommended policy components. The United States National Institute of Standards and Technology (NIST) has a number of Special Publications that complement the ISO Code of Practice. The publications provide in-depth research, recommendations, and guidance that can be applied to security domains and specific technologies. In this book, we use both to build our information security policy and program.

A. Confidence, integration, availability

B. Consistency, integrity, authentication

C. Confidentiality, integrity, availability

D. Confidentiality, integrity, awareness

2. Which of the following is an example of acting upon the goal of integrity?

A. Ensuing that only authorized users can access data

B. Ensuring that systems have 99.9% uptime

C. Ensuring that all modifications go through a change-control process

D. Ensuring that changes can be traced back to the editor

3. Which of the following is a control that relates to availability?

A. Disaster recovery site

B. Firewall

C. Training

D. Encryption

4. Which of the following is an objective of confidentiality?

A. Protection from unauthorized access

B. Protection from manipulation

C. Protection from denial of service

D. Protection from authorized access

5. As it pertains to information security, assurance is ____________________________.

A. the process of tracing actions to their source

B. the processes, policies, and controls used to develop confidence that security measures are working as intended

C. the positive identification of the person or system seeking access to secured information or systems

D. the logging of access and usage of information resources

6. Which of the following terms best describes the granting of users and systems a predetermined level of access to information resources?

A. Availability

B. Accountability

C. Assurance

D. Authorization

7. Which of the following statements identify threats to availability? (Select all that apply.)

A. Loss of processing capabilities due to natural disaster or human error

B. Loss of confidentiality due to unauthorized access

C. Loss of personnel due to accident

D. Loss of reputation from unauthorized event

8. Which of the following terms best describes the logging of access and usage of information resources?

A. Accountability

B. Acceptance

C. Accounting

D. Actuality

9. Which of the following combination of terms best describes the Five A’s of information security?

A. Awareness, acceptance, availability, accountability, authentication

B. Awareness, acceptance, authority, authentication, availability

C. Accountability, assurance, authorization, authentication, accounting

D. Acceptance, authentication, availability, assurance, accounting

10. An information owner is responsible for _____________________.

A. maintaining the systems that store, process, and transmit information

B. protecting the information and the business results derived from use of that information

C. protecting the people and processes used to access digital information

D. none of the above

11. Which of the following terms best describes ISO?

A. Internal Standards Organization

B. International Organization for Standardization

C. International Standards Organization

D. Internal Organization of Systemization

12. Which of the following statements best describes opportunistic crime?

A. Crime that is well-planned

B. Crime that is targeted

C. Crime that takes advantage of an identified weakness

D. Crime that is quick and easy

13. Which of the following terms best describes the motivation for hactivism?

A. Financial

B. Political

C. Personal

E. Fun

14. The greater the criminal work factor, the _____

A. more time it takes

B. more profitable the crime is

C. better chance of success

D. less chance of getting caught

15. Which of the following terms best describes an attack whose purpose is to make a machine or network resource unavailable for its intended use?

A. Man-in-the-middle

B. Data breach

C. Denial of service

D. SQL injection

16. Information custodians are responsible for _____

A. writing policy

B. classifying data

C. approving budgets

E. implementing safeguards

17. The National Institute of Standards and Technology (NIST) is a(n) ______

A. international organization

B. privately funded organization

C. U.S. government agency

D. European Union agency

18. The Internal Organization for Standardization (ISO) is _____

A. a nongovernmental organization

B. an international organization

C. headquartered in Geneva

D. all of the above

19. The current ISO family of standards that relates to information security is _______________.

A. BS 7799:1995

B. ISO 17799:2006

C. ISO/IEC 27000

D. None of the above

20. Which of the following terms best describes the security domain that relates to determining the appropriate safeguards as it relates to the likelihood of a threat to an organization?

A. Security policy

B. Access control

C. Compliance

D. Risk assessment

21. Which of the following terms best describes the security domain that relates to how data is classified and valued?

A. Security policy

B. Asset management

C. Compliance

D. Access control

22. Which of the following terms best describes the security domain that includes HVAC, fire suppression, and secure offices?

A. Operations

B. Communications

C. Risk assessment

D. Physical and environmental controls

23. Which of the following terms best describes the security domain that aligns most closely with the objective of confidentiality?

A. Access control

B. Compliance

C. Incident management

D. Business continuity

24. The primary objective of the __________ domain is to ensure conformance with GLBA, HIPAA, PCI/DSS, FERPA, and FISMA.

A. Security Policy

B. Compliance

C. Access Control

D. Contract and Regulatory

25. Processes that include responding to a malware infection, conducting forensics investigations, and reporting breaches are included in the _____________ domain.

A. Security Policy

B. Operations and Communications

C. Incident Management

D. Business Continuity Management

26. Which of the following terms best describes a synonym for business continuity?

A. Authorization

B. Authentication

C. Availability

D. Accountability

27. The ____________ can be held legally responsible for the safeguarding of legally protected information.

A. information user

B. information owner

C. information custodian

D. information author

28. Personnel screening, acceptable use, confidentiality agreements, and training are controls that relate to the ______________ domain.

A. Operations and Communications

B. Security Policy

C. Human Resources

D. Legal and Compliance

29. Defining organizational roles, responsibilities, and authority relate to the __________ domain.

A. Operations and Communications

B. Security Policy

C. Governance

D. Legal and Compliance

30. Which of the following security objectives is most important to an organization?

A. Confidentiality

B. Integrity

C. Availability

D. The answer may vary from organization to organization.

1. Define the security term “confidentiality.” Provide an example of a business situation where confidentiality is required.

2. Define the security term “integrity.” Provide an example of a business situation in which the loss of integrity could result in significant harm.

3. Define the security term “availability.” Provide an example of a business situation in which availability is more important than confidentiality.

Exercise 3.2: Understanding Opportunistic Cybercrime

1. Define what is meant by an “opportunistic” crime.

2. Provide an example.

3. Locate (online) a copy of the most recent Verizon Data Breach Incident Report. What percentage of cybercrimes are considered “opportunistic”?

Exercise 3.3: Understanding Hacktivism or DDoS

1. Find a recent news article relating to either hacktivism or a distributed denial of service (DDoS) attack.

2. Summarize the attack.

3. Explain why the attacker was successful (or not).

Exercise 3.4: Understanding NIST and ISO

1. At their respective websites, read the Mission and About sections of both the ISO (www.iso.org) and the NIST Computer Security Resource Center (http://csrc.nist.gov/). Describe the similarities and differences between the organizations.

2. Which do you think is more influential, and why?

Exercise 3.5: Understanding ISO 27002

1. Choose one of the ISO 27002:2013 categories and explain why this domain is of particular interest to you.

2. ISO 27002 Supplier Relationships (Section 15) was added in the 2013 version. Why do you think this section was added?

3. 27002:2013 does not mandate specific controls but leaves it to the organization to select and implement controls that suit them. NIST Special Publications provide specific guidance. In your opinion, which approach is more useful?

1. Survey ten people about the importance of the CIA model to them. Use the following table as a template. Ask them to name three types of data they have on their phone or tablet. For each data type, ask which is more important—that the information on their device be kept confidential (C), be correct (I), or be available (A).

2. Summarize the responses.

3. Are the responses inline with your expectations? Why or why not?

Project 3.2: Preparing a Report Based on the NIST Special Publications 800 Series Directory

1. Locate the NIST Special Publications 800 Series directory.

2. Read through the list of documents. Choose one that interests you and read it.

3. Prepare a report that addresses the following:

a. Why you chose this topic

b. What audience the document was written for

c. Why this document would be applicable to other audiences

d. The various sections of the document

e. Whether the document addresses confidentiality, integrity, or availability

Project 3.3: Preparing a Report on ISO 27001 Certification

1. Research how many organizations are currently ISO 27001 certified.

2. Prepare a report on how an organization achieves ISO 27001 certification.

“Federal Information Security Management Act (FISMA),” accessed on 06/2013, http://csrc.nist.gov/drivers/documents/FISMA-final.pdf.

“Public Law 107 – 347 – E-Government Act of 2002,” official website of the U.S. Government Printing Office, accessed on 06/2013, www.gpo.gov/fdsys/pkg/PLAW-107publ347/content-detail.html.

“International Standard ISO/IEC 27000,” Second Edition 2012-12-01, published by the ISO, Switzerland.

“International Standard ISO/IEC 27002:2013,” Second Edition 2013-10-01, published by the ISO, Switzerland.

“About ISO,” official website of the International Organization for Standardization (ISO), accessed on 06/2013, www.iso.org/iso/home/about.htm.

“A Short History of the ISO 27000 Standards: Official,” The ISO 27000 Directory, accessed on 06/2013, www.27000.org/thepast.htm.

“An Introduction to ISO 27001, ISO 27002, ... ISO 27008,” The ISO 27000 Directory, accessed on 06/2013, www.27000.org/index.htm.

“The ISO/IEC 27000 Family of Information Security Standards,” IT Governance, accessed on 06/2013, www.itgovernance.co.uk/iso27000-family.aspx.

“ISO/IEC 27000 Series,” Wikipedia, accessed on 06/2013, http://en.wikipedia.org/wiki/ISO/IEC_27000-series.

“NIST Computer Security Division,” official website of the NIST Computer Security Resource Center, accessed on 06/2013, http://csrc.nist.gov/.

“Federal Information Processing Standards (FIPS) Publications,” official website of the NIST Computer Security Resource Center, accessed on 06/2013, http://csrc.nist.gov/publications/PubsFIPS.html.

“Special Publications (800 Series) Directory,” official website of the NIST Computer Security Resource Center, accessed on 06/2013, http://csrc.nist.gov/publications/PubsSPs.html.

“Special Publications (800 Series) Directory by Legal requirement,” official website of the NIST Computer Security Resource Center, accessed on 06/2013, http://csrc.nist.gov/publications/PubByLR.html.

“Hacktivism,” Wikipedia, accessed on 06/2013, http://en.wikipedia.org/wiki/index.html?curid=162600.

Kuligowski, Christine, “Comparison of IT Security Standards (2009),” accessed on 06/2013, www.federalcybersecurity.org/CourseFiles/WhitePapers/ISOvNIST.pdf.

Metac0m, “What Is Hactivism? 2.0,” published by The Hacktivist, December 2003, accessed on 06/2013, www.thehacktivist.com/whatishacktivism.pdf.

Poulen, K. and Zetter, K. “U.S. Intelligence Analyst Arrested in WikiLeaks Video Probe,” Wired Magazine, accessed on 06/2013, http://www.wired.com/threatlevel/2010/06/leak/.

“What Is WikiLeaks,” WikiLeaks, accessed on 06/2013, http://wikileaks.org/About.html.

“WikiLeaks Fast Facts,” CNN, accessed on 06/01/2013, www.cnn.com/2013/06/03/world/wikileaks-fast-facts/.