ECS 6700 New England College Information Technology Infrastructure Security Questions Question-1 : Review the required reading material and summarize one o

ECS 6700 New England College Information Technology Infrastructure Security Questions Question-1 : Review the required reading material and summarize one of the scholarly articles listed on the selected websites. In 2-3 paragraphs, and using your own words, explain why ethical hacking is necessary in today’s complex business environment.

Reference :1.https://resources.infosecinstitute.com/category/pen-testing-1/

2.https://resources.infosecinstitute.com/the-benefits-of-learning-ethical-hacking/

3.https://www.theatlantic.com/technology/archive/2015/12/white-hat-ethical-hacking-cybersecurity/419355/

4. https://www.youtube.com/watch?v=eNQycQwKV7Y&feature=youtu.be

Question-2 : What is the weakest link in the security of an IT infrastructure? What are some of the strategies for reducing the risks? An initial post must be between 250-300 words

Reference : Attached ppt Fundamentals of Information
Systems Security
Lesson 1
Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Learning Objective(s)
▪ Explain information systems security and
its effect on people and businesses.
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 2
Key Concepts
▪ Information systems security concepts
▪ Confidentiality, integrity, and availability (CIA)
▪ The seven domains of an IT infrastructure
▪ The weakest link in the security of an IT
infrastructure
▪ IT security policy framework and data
classification standard
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 3
Information Systems Security
Internet
• Is a worldwide network with more than 2 billion users
• Includes governments, businesses, and
organizations
• Links communication networks to one another
World Wide Web
• A system that defines how documents and
resources are related across network machines
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 4
Recent Data Breaches: Examples
Adobe Systems Incorporated, 2013
• Hackers published data for 150 million accounts
• Stole encrypted customer credit card data
• Compromised login credentials
U.S. Office of Personnel Management, 2015
• Data breach impacted 22 million people
• Stole SSNs, names, places of birth, addresses
• Millions must be monitored for identity theft for years
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 5
Cyberspace: The New Frontier
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 6
Internet of Things (IoT)
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 7
Risks, Threats, and Vulnerabilities
Risk
Likelihood that something bad will
happen to an asset
Threat
Any action that could damage an asset
Vulnerability
A weakness that allows a threat to be
realized or to have an effect on an asset
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 8
What Is Information Systems
Security?
Information
system
Hardware, operating system, and
application software that work together
to collect, process, and store data for
individuals and organizations
Information
system
security
The collection of activities that protect
the information system and the data
stored in it
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 9
U.S. Compliance Laws Drive Need
for Information Systems Security
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 10
Tenets of Information Systems
Security
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 11
Confidentiality
Private data
of
individuals
Fundamentals of Information Systems Security
Intellectual
property of
businesses
National
security for
countries
and
government
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 12
Confidentiality (cont.)
Cryptography
Practice of hiding data and keeping
it away from unauthorized users
Encryption
The process of transforming data
from cleartext into ciphertext
Ciphertext
The scrambled data that are the
result of encrypting cleartext
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 13
Encryption of Cleartext into
Ciphertext
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 14
Integrity
Maintain valid, uncorrupted, and accurate
information
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 15
Availability
▪ In the context of information security
• The amount of time users can use a system,
application, and data
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 16
Availability Time Measurements
Uptime
Downtime
Availability [A = (Total Uptime)/(Total Uptime + Total Downtime)]
Mean time to failure (MTTF)
Mean time to repair (MTTR)
Mean time between failures (MTBF)
Recovery time objective (RTO)
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 17
Seven Domains of a Typical IT
Infrastructure
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 18
User Domain
Roles and tasks
• Users can access systems, applications, and data
depending upon their defined access rights.
Responsibilities
• Employees are responsible for their use of IT assets.
Accountability
• HR department is accountable for implementing proper
employee background checks.
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 19
Common Threats in the User Domain
▪ Lack of user awareness
▪ User apathy toward policies
▪ User violating security policy
▪ User inserting CD/USB with personal files
▪ User downloading photos, music, or videos
▪ User destructing systems, applications, and data
▪ Disgruntled employee attacking organization or
committing sabotage
▪ Employee blackmail or extortion
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 20
Workstation Domain
Roles and tasks
• Configure hardware, harden systems, and verify
antivirus files.
Responsibilities
• Ensure the integrity of user workstations and data.
Accountability
• Director of IT security is generally in charge of ensuring
that the Workstation Domain conforms to policy.
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 21
Common Threats in the Workstation
Domain
▪ Unauthorized workstation access
▪ Unauthorized access to systems, applications,
and data
▪ Desktop or laptop operating system vulnerabilities
▪ Desktop or laptop application software
vulnerabilities or patches
▪ Viruses, malicious code, and other malware
▪ User inserting CD/DVD/USB with personal files
▪ User downloading photos, music, or videos
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 22
LAN Domain
Roles and tasks
• Includes both physical network components and logical
configuration of services for users.
Responsibilities
• LAN support group is in charge of physical components
and logical elements.
Accountability
• LAN manager’s duty is to maximize use and integrity of
data within the LAN Domain.
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 23
Common Threats in the LAN Domain
▪ Unauthorized physical access to LAN
▪ Unauthorized access to systems, applications,
and data
▪ LAN server operating system vulnerabilities
▪ LAN server application software vulnerabilities
and software patch updates
▪ Rogue users on WLANs
▪ Confidentiality of data on WLANs
▪ LAN server configuration guidelines and
standards
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 24
LAN-to-WAN Domain
Roles and tasks
• Includes both the physical pieces and logical design of
security appliances. Physical parts need to be managed to
give easy access to the service.
Responsibilities
• Physical components, logical elements, and applying the
defined security controls.
Accountability
• Ensure that LAN-to-WAN Domain security policies,
standards, procedures, and guidelines are used.
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 25
Common Threats in the
LAN-to-WAN Domain
▪ Unauthorized probing and port scanning
▪ Unauthorized access
▪ IP router, firewall, and network appliance
operating system vulnerability
▪ Download of unknown file type attachments from
unknown sources
▪ Unknown email attachments and embedded URL
links received by local users
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 26
WAN Domain
Roles and tasks
• Allow users the most access possible while making
sure what goes in and out is safe.
Responsibilities
• Physical components and logical elements.
Accountability
• Maintain, update, and provide technical support and
ensure that the company meets security policies,
standards, procedures, and guidelines.
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 27
Common Threats in the WAN
Domain (Internet)
▪ Open, public, and accessible data
▪ Most traffic being sent as cleartext
▪ Vulnerable to eavesdropping
▪ Vulnerable to malicious attacks
▪ Vulnerable to denial of service
(DoS) and distributed denial of
service (DDoS) attacks
▪ Vulnerable to corruption of information/data
▪ Insecure TCP/IP applications
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 28
Common Threats in the WAN
Domain (Connectivity)
▪ Commingling of WAN IP traffic on the same
service provider router and infrastructure
▪ Maintaining high WAN service availability
▪ Using SNMP network management
applications and protocols maliciously (ICMP,
Telnet, SNMP, DNS, etc.)
▪ SNMP alarms and security monitoring 24 X 7
X 365
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 29
Remote Access Domain
Roles and tasks
• Connect mobile users to their IT systems through the
public Internet.
Responsibilities
• Maintain, update, and troubleshoot the hardware and
logical remote access connection.
Accountability
• Ensure that the Remote Access Domain security plans,
standards, methods, and guidelines are used.
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 30
Common Threats in the Remote
Access Domain
▪ Brute-force user ID and password attacks
▪ Multiple logon retries and access control attacks
▪ Unauthorized remote access to IT systems,
applications, and data
▪ Confidential data compromised remotely
▪ Data leakage in violation of data classification
standards
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 31
System/Application Domain
Roles and tasks
• Includes hardware and its logical design.
• Secure mission-critical applications and intellectual property
assets both physically and logically.
Responsibilities
• Server systems administration, database design and
management, designing access rights to systems and
applications, and more.
Accountability
• Ensure that security policies, standards, procedures, and
guidelines are in compliance.
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 32
Common Threats in the
System/Application Domain
▪ Unauthorized access to data centers, computer
rooms, and wiring closets
▪ Downtime of servers to perform maintenance
▪ Server operating systems software vulnerability
▪ Insecure cloud computing virtual environments by
default
▪ Corrupt or lost data
▪ Loss of backed-up data as backup media are
reused
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 33
Weakest Link in the Security of an IT
Infrastructure
User is weakest link in security
Strategies for reducing risk
• Check background of job candidates carefully.
• Evaluate staff regularly.
• Rotate access to sensitive systems, applications, and
data among staff positions.
• Test applications and software and review for quality
• Regularly review security plans.
• Perform annual security control audits.
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 34
Ethics and the Internet
▪ Human behavior online is often less mature
than in normal social settings
▪ Demand for systems security professionals is
growing so rapidly
▪ U.S. government and Internet Architecture
Board (IAB) defined a policy regarding
acceptable use of Internet geared toward U.S.
citizens
• Policy is not a law or mandated
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 35
IT Security Policy Framework
Policy
• A short written statement that defines a course of
action that applies to entire organization
Standard
• A detailed written definition of how software and
hardware are to be used
Procedures
• Written instructions for how to use policies and
standards
Guidelines
• Suggested course of action for using policy,
standard, or procedure
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 36
Hierarchical IT Security Policy
Framework
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 37
Foundational IT Security Policies
▪ Acceptable use policy (AUP)
▪ Security awareness policy
▪ Asset classification policy
▪ Asset protection policy
▪ Asset management policy
▪ Vulnerability assessment/management
▪ Threat assessment and monitoring
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 38
Data Classification Standards
Private data
Data about people that must be kept
private
Confidential
Information or data owned by the
organization
Internal use
only
Information or data shared internally
by an organization
Public domain
data
Information or data shared with the
public
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 39
Summary
▪ Information systems security concepts
▪ Confidentiality, integrity, and availability (CIA)
▪ The seven domains of an IT infrastructure
▪ The weakest link in the security of an IT
infrastructure
▪ IT security policy framework and data
classification standard
Fundamentals of Information Systems Security
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 40

Purchase answer to see full
attachment