Information Assurance And Security - Chapter 2 - Lesson 1
- 1. Principles of Information Security, Fifth Edition Chapter 2 The Need for Security Lesson 1 - Introduction
- 2. Learning Objectives • Upon completion of this material, you should be able to: – Discuss the organizational business need for information security Principles of Information Security, Fifth Edition 2
- 3. Introduction • The primary mission of an information security program is to ensure information assets— information and the systems that house them— remain safe and useful. • If no threats existed, resources could be used exclusively to improve systems that contain, use, and transmit information. • Threat of attacks on information systems is a constant concern. Principles of Information Security, Fifth Edition 3
- 4. Business Needs First • Information security performs four important functions for an organization: – Protecting the organization’s ability to function – Protecting the data and information the organization collects and uses – Enabling the safe operation of applications running on the organization’s IT systems – Safeguarding the organization’s technology assets Principles of Information Security, Fifth Edition 4
- 5. Protecting the Functionality of an Organization • Management (general and IT) is responsible for facilitating security program. • Implementing information security has more to do with management than technology. • Communities of interest should address information security in terms of business impact and cost of business interruption. Principles of Information Security, Fifth Edition 5
- 6. Protecting Data That Organizations Collect and Use • Without data, an organization loses its record of transactions and ability to deliver value to customers. • Protecting data in transmission, in processing, and at rest (storage) is a critical aspect of information security. Principles of Information Security, Fifth Edition 6
- 7. Enabling the Safe Operation of Applications • Organization needs environments that safeguard applications using IT systems. • Management must continue to oversee infrastructure once in place—not relegate to IT department. Principles of Information Security, Fifth Edition 7
- 8. Safeguarding Technology Assets in Organizations • Organizations must employ secure infrastructure hardware appropriate to the size and scope of the enterprise. • Additional security services may be needed as the organization grows. • More robust solutions should replace security programs the organization has outgrown. Principles of Information Security, Fifth Edition 8