Day 2 - Chapter 1
Project
The company under review must not be associated with Mississippi State University.
Groups will be decided on Monday.
Slide Notes
This is not hacking 101.
We are trying to wrap our head around how we protect information and what business decisions are made in this process
Outline
- CIA Triad
- Other Security Concepts
- Data Classification
Security in a nutshell
Subjects are allowed or denied access to an object.
Subjects
The user/process/system requesting access to a protected resource
Objects
The protected resource
CIA Triad
Confidentiality
- Keeping information protected from unauthorized access
- Violation
- Capturing network traffic / Eavesdropping
- Social engineering
- Port scanning
- Shoulder surfing
- Relies on Integrity
- Necessary, but not sufficient
- Previous versions of Study Guide: Most important goal for government agencies
Violation of Confidentiality
Integrity
- Information can only be modified by authorized subjects
- Information is protected from “honest mistakes”
- Information is valid, consistent, and verifiable
- Violations
- Viruses
- “Logic Bombs”
- Sabotage
- Dependent on confidentiality
Violation of Integrity
Availability
- Information is timely and accessible to subjects
- Handles interruptions and outages
- Violations
- Attacks (denial of service)
- Device failure
- Environmental issues
- Dependent on both confidentiality & integrity
- Most important goal for business organizations (p.7)