Network Security

Front 1

IT SECURITY

Back 1

protection of an automated information system in order to attain the applicable objectives of preserving the integrity, availability, confidentiality of information system resources (hardware, software, information)

Front 2

CONFIDENTIALITY

Back 2

prevent unauthorised disclosure of information

Front 3

INTEGRITY

Back 3

prevent unauthorised modification of information

Front 4

AVAILABILITY

Back 4

guarantee access to information

Front 5

AUTHENTICITY

Back 5

determine "who" (who is accessing, who sent the message, etc)

Front 6

ACCOUNTABILITY

Back 6

ensure traceability of actions

Front 7

SECURITY MANAGEMENT

Back 7

process with the aim to achieve and maintain appropriate level of security objectives

- determining objectives, requirements, strategies and policies

- identifying and analyzing threats and risks

- detecting and reacting to incidents

Front 8

PHYSICAL SECURITY

Back 8

- emergencies (fire, smoke, blackout, etc)

- natural disaster ( earthquakes, storm damage)
- human intervention (sabotage, vandalism)

Front 9

PRIVACY

Back 9

- right of an individual to determine what information about himself may be communicated to others

- measure of control an individual has over information about himself

Front 10

DATA PROTECTION

Back 10

legal protection of an individual's privacy

Front 11

HUMAN RESOURCES

Back 11

- awareness (security issues) --> what
- training --> how

- education --> why

- personnel security

Front 12

AUDITING (ISPEZIONE)

Back 12

periodic assessment about the effectiveness and efficiency of the planned security and implemented controls

an auditor can be external or internal

Front 13

SECURITY POLICIES (3 TYPES)

Back 13

ORGANISATIONAL: how an organization manages and protects resources to achieve objectives

TECHINICAL: how a computing system prevents violation

CONFIGURATION: configuration files for security solutions and tools

Front 14

SECURITY RISK ANALYSIS (4 APPROACHES)

Back 14

1. BASELINE APPROACH

2. INFORMAL APPROACH

3. FORMAL APPROACH

4. COMBINED APPROACH

Front 15

BASELINE APPROACH

Back 15

- addresses most common threats

- easy, cheap, can be replicated

- no attention to organization

- too much or too little security

- good for small organizations

Front 16

INFORMAL APPROACH

Back 16

- incorrect assessment for some risks

- informal analysis

- quick, cheap

- small, medium organisations

Front 17

FORMAL APPROACH

Back 17

- numbered stages, likelihood of risk and consequences, appropriate controls

- slow and costly

- big organisations

Front 18

COMBINED APPROACH

Back 18

- baseline on all systems

- informal analysis

- formal assessment

- iterated and extended over time

Front 19

ASSET

Back 19

anything that has value for the organisation

Front 20

THREAT

Back 20

potential incident which may result in harm to system/organisation

Front 21

VULNERABILITY

Back 21

a weakness of an asset which can be a threat

Front 22

RISK

Back 22

the potential that a given threat will exploit vulnerabilities of an asset to cause loss or damage to the asset