Information Security
InfoSec Architecture
Part of Digital Enterprise Architecture · page 5 of 5
What is Information Security?
The goal of information security is to protect information assets (e.g erecords, document,s data stores, processors, networks), from security related threats.
It foucses on three key properties of information:
- Confidentiality
- Integrity
- Availability
This is known as the CIA triad. InfoSec architecture places information assets at the core. of information, processes, systems, networks and internet.
Identifying Information Assets
What do we need to protect? Consider these:
- Personally Identifiable Information (PII)
- Intellectual Property
- Transactional Data
- Data Sources
- Format of Information
- Software
- Physical/Devices/Equipment
- Services (cloud, value chain)
- Custodianship
Classifying Information Assets
Information assets have recognisable and manageable value, risk content and life cycles. Organisations can have a range of classification schemes for data/information based on the nature of their beueinsess, security requirements, or even regulatory requirements. The classification of data may change over time. A business plan might be "commercial in confidence" until the day it is publically released.
| Classification |
|---|
| Confidential |
| Internal |
| External |
Physical Assets
Within the InfoSec context, assets include not only the data itself, but also devices or applications within computing environments, that support the creation, processing and transportation of information and related busienss activities.
What are the InfoSec Threats?
Security threats result from the potential for a threat actor to exploit vulnerabilities (i.e known exposures) within IT systems.
Threat actors include:
- Insiders: Staff, contractors, trusted partners
- External agents: Criminals, hackers, activists, foreign powers
- "Forces of nature": Earthquates, fires, floods.
Threats can be assessed in terms of:
- Level of technical difficulty required to explot a vulnerability
- Motivation of threat actor (value of successful attack) -Potential impact of an attack on the organisation.
12 Categories of Common Threats to Information Security
| Category of Threat | Attack Examples |
|---|---|
| Compromises to intellectual property | Piracy, copyright infringement |
| Deviations in equality of service | Internet Service Provider (ISP), power, or WAN service problems |
| Espionage or trespass | Unauthorised access and/or data collection |
| Forces of nature | Fire, floods, eatrhquakes, lightning |
| Human error or failure | Accidents, employee mistakes |
| Information extortion | Blackmail, information disclosure |
| Sabotage or vandalism | Destruction of systems or information |
| Software attacks | Viruses, worms, macros, DDOS |
| Technical hardware failures or errors | Equipment failure |
| Technical software failures or errors | Bugs, code problems, unknown loopholes |
| Technological obsolence | Antiquated or outdated technologies |
| Theft | Illegal confiscation of equipment or information |
The threat profile for any organisation will depend on the nature of its informaiton assets and the potential value those assets might represent to potential threat agents.
For example:
- Credit card information is of high value to those interested in credit-card fraud
- Personally identifiable information might be of value those simply wanting to target individuals for further criminal activity.
- Intellectual property is of value to others in the same industryy, possibly working on behalf of state actors.
Organisations operate in a specific context or environment.
Consider:
- Nature of Business activities (retail, wholesale, service, outputs)
- Business environments (competition)
- Industry/sector (finance, government, medical)
- Geopolitical environment (location, economy)
- Regulatory compliance
- Others.
What is an InfoSec risk?
The risk equation is as follow:
[Risk = Impact x Likelihood]Impact is the cost measured in financial terms or reputational damage Likelihood is often rated in terms of estimated period between occurence (e.g once per year, once in ten years?)
At an organisational level, security threats generally impact 3 key risk areas:
- Financial Loss due to theft, destruction of assets, ransom demands.
- Reputational Loss due to privacy breachges, adverse impact on customers.
- Business Interruption due to malware, system outages, natural disasters.
Examples of Threats and Impact
| Type of Threat | Method | Impact |
|---|---|---|
| Intellectual Property Crimes | An internet facing computer is compromised and exploiuted for storage of illicit material | Reputation, Organisation is an unsuspecting participant |
| Theft of classified information | Internal computers are infected with a targeted virus. Staff member is a willing participant | Privacy breach, reputation, organisation is the targeted victim |
| Extortion Denial-of-Service | Internal computers are infected with a bot (virus) and used to participate in an attack as part of a botnet | Operational impact as resources are redirected. Reputation. Organisation is an unsuspecting participant |
| Denial-of-Service (political) | Internal systems are infected with a virus which is used to disrupt business sytems | Operation impact on business. Organisation is the targeted victim |
| Vandalism | External-facing websites are defaced | Reputation. Organisation is the targeted victim |
Common Information Security Controls
Technical Safeguards
- Access Control
- Audit Control
- Integrity
- Personal or Entity Authentication
- Transmission Security
Physical Safeguards
- Facility Access Control
- Workstation Use
- Workstation Security
- Device and Media Control
Administrative Safeguards
- Security Management Process
- Work Force Securiity
- Information Access Management
- Security Awareness and Training
- Contingency Plan Evaluation
- Business Associate Contract
There are InfoSec controls on every architecture layer.
Types of InfoSec Controls
Security Controls are split into:
- Preventative: Prevent security incidents from happening.
- Corrective: Allow effective incident response, contain the damage.
- Detective: Necessary in order to know whether controls are working or have faied.
- Recovery: To be used after a disaster to restore a normal service.
Defense-In-Depth
DID is also referred to as layerd security. Defense-in-depth is the concept of protecting a computer network with a series of defensive mechanisms such that if one mechanism fials, another will already be in place to thwart the attack (SANS).
The strategy recommends a balance between the protection capability and cost, perforance, and oeprational considerations (NSA).
Beyond the Organisation
Vulnerabilities can exist outside the organisation and ecosystem
| Layer | Vulnerability |
|---|---|
| Government | Laws prohibiting effective cybersecurity like limits on encryption, badly drafted cybercrime laws, excessive government surveillance |
| International | Nation-state cyberattacks, lack of workable international agreements to limit cyberattacks, supranational legal rules that weaken cybersecurity (for example, some International Telecommunications Union proposals) |
Internal Policies or Plans of action is the most common focus of traditional InfoSec.
Further Frameworks
- ISO 27000 series - Documents the body of knowledge that defines security controls that cna be applied to most oprganisations in most circumstances (best-practice).
- NIST SP800 and SP1800 series - comprehensive library of security references, freely available to download.
- NZISM (NZ Information Security Manual) - The NZ coutnerpart ot the key NIST publications.
- COBIT - A governance framework developed by ISACA for the management of information security often used as an audit tool.
- SABSA - applies the Zachman architecture model of information security. It focuses on business drivers for which security can support and enable strategic initiatives. Incorporates risk management, information assurance, governance and a structure approach for service management and infrastructure design.