1.

developing secure information system:

Information systems security policies primarily address threats. In the absence of threats, policies would
be unnecessary—one could do as one chooses with information. Unfortunately, threats do exist and
information systems security policies are necessary to provide a framework for selecting and
implementing countermeasures against them. An enforceable written policy helps ensure that everyone
within the organization coherently behaves in an acceptable manner with respect to information
security. A well-designed information security policy defines the objectives of the information system of
an organization and outlines a strategy to achieve these stated objectives. Conversely, an information
system without security policies is likely to be a disjoint collection of countermeasures that address a
variety of threats [10]. Information systems security policies, then, can often be used to help integrate
the many different aspects of an enterprise to achieve business objectives. Policies, standards,
guidelines, and training materials that are obsolete and not enforced are particularly dangerous to an
organization because management is often deceived into believing that security policies do not exist and
that the organization is operating more effectively than it actually is. All organizations need to
periodically review, test, and discard un-enforced and otherwise obsolete rules, controls, and
procedures to avoid this false sense of security. An alternative to periodic reviews is to specify a time
limit for applying policies and standards and assign limited life span to mandatory controls, specifying
when they should become effective and when they should be nullified or replaced—a technique
generally referred to as sunsetting. Computers are inherently vulnerable to a wide array of threats. It is
generally worse to have no safeguards at all than to think that security is in place when it is not. This
situation, known as negative value security, fosters complacency and diverts attention from the
information assets, which are mistakenly presumed to be secure, making the information more
attractive to hackers or more vulnerable to accidental loss. Information systems security policies are
designed to address these threats.\
2. Application development security: encompasses measures taken throughout
the code's life-cycle to prevent gaps in the security policyof an application or
the underlying system (vulnerabilities) through flaws in
the design, development, deployment, upgrade,
or maintenance or database of the application.
Applications only control the kind of resources granted to them, and
not which resources are granted to them. They, in turn, determine the use of these
resources by users of the application through application security.

Threats, attacks, vulnerabilities, and countermeasures[edit]

According to the patterns & practices Improving Web Application Security book, the
following terms are relevant to application security:[1]

 Asset. A resource of value such as the data in a database or on the file system,
or a system resource.
 Threat. Anything that can exploit a vulnerability and obtain, damage, or destroy
an asset.
 Vulnerability. A weakness or gap in security program that can be exploited by
threats to gain unauthorized access to an asset.
 Attack (or exploit). An action taken to harm an asset.
 Countermeasure. A safeguard that addresses a threat and mitigates risk.

3. Information Security Governance and Risk Management

The first action of a management program to implement information security is to have a
security program in place. Though some argue the first act would be to gain some real "proof of
concept" and "explainable thru display on the monitor screen" security knowledge. Start with
maybe understanding where OS passwords are stored within the code inside a file within a
directory. If you don't understand Operating Systems at the root directory level maybe you
should seek out advice from somebody who does before even beginning to implement security
program management and objectives.
Security Program Objectives

 Protect the company and its assets.

 Manage Risks by Identifying assets, discovering threats and estimating the risk
 Provide direction for security activities by framing of information security policies,
procedures, standards, guidelines and baselines
 Information Classification
 Security Organization and
 Security Education

Information Security Management Governance[edit]

Security Governance[edit]
Governance is the set of responsibilities and practices exercised by the board and executive
management with the goal of providing strategic direction, ensuring that objectives are achieved,
ascertaining that risks are managed appropriately and verifying that the enterprise's resources are
used responsibly.
Information Security Governance or ISG, is a subset discipline of Corporate Governance focused
on information Security systems and their performance and risk management.

Information Risk Management[edit]

Information risk management (IRM) is the process of identifying and assessing risk, realizing the
limitations in reducing it to an acceptable level, and implementing the right mechanisms to
maintain that level.
Risk Management Concepts[edit]
Categories of Risks

 Physical damage- Fire, water, vandalism, power loss, and natural disasters
 Human interaction- Accidental or intentional action or inaction that can disrupt productivity
 Equipment malfunction- Failure of systems and peripheral devices
 Inside and outside attacks- Hacking, cracking, and attacking
 Misuse of data- Sharing trade secrets, fraud, espionage, and theft
 Loss of data- Intentional or unintentional loss of information through destructive means
 Application error- Computation errors, input errors, and buffer overflows
 Social Status- Loss of Customer base and reputatio
A risk management team should have the ability and follow the best practices, some of them
which include

 Establishing a risk acceptance level as provided by senior management

 Documenting risk assessment processes and procedures
 Establishing proper procedures for identifying and mitigating risks
 Getting support from senior management for appropriate resource and fund allocation
 Defining contingency plans where assessments indicate that they are necessary
4. security architecture & design security issues in hardware
 5. Data storage device
A data storage device is a device for recording (storing) information (data).
Recording can be done using virtually any form of energy, spanning from
manual muscle power in handwriting, to acoustic vibrations
in phonographic recording, to electromagnetic energy modulating magnetic
tape and optical discs.
A storage device may hold information, process information, or both. A device
that only holds information is a recording medium. Devices that process
information (data storage equipment) may either access a separate portable
(removable) recording medium or a permanent component to store and
retrieve data.

 Electronic data storage requires electrical power to store and retrieve that data.
Most storage devices that do not require vision and a brain to read data fall into
this category. Electromagnetic data may be stored in either an
analog data or digital dataformat on a variety of media. This type of data is
considered to be electronically encoded data, whether it is electronically stored in
a semiconductor device, for it is certain that a semiconductor device was used to
record it on its medium. Most electronically processed data storage media
(including some forms of computer data storage) are considered permanent
(non-volatile) storage, that is, the data will remain stored when power is removed
from the device. In contrast, most electronically stored information within most
types of semiconductor (computer chips) microcircuits are volatile memory, for it
vanishes if power is removed. Paper card storage
 Punched card (mechanical)
 Cams and tracers (pipe organ combination-action memory memorizing stop
selections)
 Tape storage (long, thin, flexible, linearly moving bands)
 Paper tape (mechanical)
 Magnetic tape (a tape passing one or more read/write/erase heads)
 Disk storage (flat, round, rotating object)
 Gramophone record (used for distributing some 1980s home computer
programs) (mechanical)
 Carousel memory (magnetic rolls)
 Floppy disk, ZIP disk (removable) (magnetic)
 Holographic
 Optical disc such as CD, DVD, Blu-ray Disc
 Minidisc
 Hard disk drive (magnetic)
 Magnetic bubble memory
 Flash memory/memory card (solid state semiconductor memory)
 xD-Picture Card
 MultiMediaCard
 USB flash drive (also known as a "thumb drive" or "keydrive")
 SmartMedia
 CompactFlash I and II
 Secure Digital
  Sony Memory Stick (Std/Duo/PRO/MagicGate versions)
 Solid-state drive

CCTV:
Closed-circuit television (CCTV), also known as video surveillance, is the use
of video cameras to transmit a signal to a specific place, on a limited set of monitors.
It differs from broadcast television in that the signal is not openly transmitted, though
it may employ point to point (P2P), point to multipoint (P2MP), or mesh wireless
links. Though almost all video cameras fit this definition, the term is most often
applied to those used for surveillance in areas that may need monitoring such as
banks, casinos, airports, military installations, and convenience
stores. Videotelephony is seldom called "CCTV" but the use of video in distance
education, where it is an important tool, is often so called.[1][2]
Many sporting events in the United States use CCTV inside the venue for fans to
see the action while they are away from their seats. This use of CCTV is not used
for surveillance purposes.
In industrial plants, CCTV equipment may be used to observe parts of a process
from a central control room, for example when the environment is not suitable for
humans. CCTV systems may operate continuously or only as required to monitor a
particular event. A more advanced form of CCTV, utilizing digital video recorders,
(DVRs), provides recording for possibly many years, with a variety of quality and
performance options and extra features (such as motion detection and email alerts).
More recently, decentralized IP cameras, some equipped with megapixel sensors,
support recording directly to network-attached storage devices, or internal flash for
completely stand-alone operation. Surveillance of the public using CCTV is
particularly common in many areas around the world. In recent years, the use
of body worn video cameras has been introduced as a new form of surveillance.
IDS:
An intrusion detection system (IDS) is a device or software application that
monitors a network or systems for malicious activity or policy violations. Any
detected activity or violation is typically reported either to an administrator or
collected centrally using a security information and event management (SIEM)
system. A SIEM system combines outputs from multiple sources, and uses alarm
filtering techniques to distinguish malicious activity from false alarms.
TYPES:
Network intrusion detection systems[edit]
Network intrusion detection systems (NIDS) are placed at a strategic point or points
within the network to monitor traffic to and from all devices on the network. It
performs an analysis of passing traffic on the entire subnet, and matches the traffic
that is passed on the subnets to the library of known attacks. Once an attack is
identified, or abnormal behavior is sensed, the alert can be sent to the administrator
Host intrusion detection systems[edit]
Main article: Host-based intrusion detection system
Host intrusion detection systems (HIDS) run on individual hosts or devices on the
network. A HIDS monitors the inbound and outbound packets from the device only
and will alert the user or administrator if suspicious activity is detected. It takes a
snapshot of existing system files and matches it to the previous snapshot. If the
critical system files were modified or deleted, an alert is sent to the administrator to
investigate. An example of HIDS usage can be seen on mission critical machines,
which are not expected to change their configurations.
Classification[edit]
Intrusion prevention systems can be classified into four different types:[6][11]
1. Network-based intrusion prevention system (NIPS): monitors the entire
network for suspicious traffic by analyzing protocol activity.
2. Wireless intrusion prevention systems (WIPS): monitor a wireless network
for suspicious traffic by analyzing wireless networking protocols.
3. Network behavior analysis (NBA): examines network traffic to identify
threats that generate unusual traffic flows, such as distributed denial of
service (DDoS) attacks, certain forms of malware and policy violations.
4. Host-based intrusion prevention system (HIPS): an installed software
package which monitors a single host for suspicious activity by analyzing events
occurring within that host.
Detection methods[edit]
The majority of intrusion prevention systems utilize one of three detection methods:
signature-based, statistical anomaly-based, and stateful protocol analysis.[8]:301[12]
1. Signature-Based Detection: Signature based IDS monitors packets in the
Network and compares with pre-configured and pre-determined attack patterns
known as signatures.
2. Statistical anomaly-based detection: An IDS which is anomaly based will
monitor network traffic and compare it against an established baseline. The
baseline will identify what is "normal" for that network – what sort of bandwidth is
generally used, what protocols are used that it may raise a False Positive alarm
for a legitimate use of bandwidth if the baselines are not intelligently
configured.[13]
3. Stateful Protocol Analysis Detection: This method identifies deviations of
protocol states by comparing observed events with “predetermined profiles of
generally accepted definitions of benign activity.”[8]

##.Physical Security of IT Assets, Access Control.

Ans:- Without paying proper attention to the physical security of information asset your IT assets
and infrastructure are always under security threats from known or unknown sources or from
accidental hazards. An IT security manager or designer will always need to pay equal or even
more attention to ensure that his all the information assets are physically secured. It is not
necessary that all the physical security risk to IT assets can be only from physical break into the
IT server or assets room, but there are major risk related to environmental risks such as fire. To
control the physical security of all IT assets you need to identify all the assets that you consider
sensitive and important for your organization. The physical security of IT assets can be broadly
categorized based on the following criteria:
1. Security of Asset Location
2. Human access control to the security room
3. Environtal control
Security of asset location
The location of the information asset room need to physical secured. It is always a good practice
not to disclose the location of your server room to public. The lesser people know about the
location of your server room the better. First of all, you need to make sure that there one entry to
your server room including one emergency exit door. Secondly, the entrance of the access door
should not be directly visible to the location of your office where the majority of the officials
work. Thirdly, before the main access door there should be another small door or space to reduce
the risk of piggy backing.
Human access control
Before entering the server room all the personal need to be authorized to enter the room-there
can be an exception to the daily maintenance team. But it is better to have the presence of a
supervisor when maintence works are carried out. All the personals need to be physically
verified and must carry an identity card, if possible implement digital access control or any
biometric access control. The security person before the access room must be present always and
they there may be a pool of security guards who will be only duty so as they can be familiar with
the faces entering the room on regular basis. Finally, there should be close circuit camera both in
and outside of the asset room and you need to make sure the access to the digital recording
devices are properly monitored and logged.
Environmental security control
You need to make sure that all the equipment installed inside the server rooms are being auditor
regularly. Make sure there are at least two emergency power-off switches for the server room
itself-one inside and the other outside the room. All the electrical wiring should be placed inside
fire-resistance panels and if there are any office desk or cabinets, then use only those equipments
made of fire-resistance materials. Any kind of food intake must be strictly prohibited in the
server room
## backup security measures
Top considerations for implementing secure backup and recovery
In the last few years there have been many headlines about high-profile incidents of lost or stolen
backup tapes. Despite increasing attention to security, backup procedures are often neglected in
overall security policies. The main reason for that discrepancy is that, historically, backup and
security have had almost opposite goals. Security procedures often require strong access control
to user's data. Backup software, however, is optimized to simplify recovery, sometimes to a
different platform or different location and often by someone other than the original owner of the
data.
Using the example of the most popular open source backup and recovery software, Amanda, we
will review best practices for ensuring security of backup data. Specifically, we will review the
following aspects of backup security:
 Authentication of users and backup clients to the backup server.
 Role based access control lists for all backup and recovery operations.
 Data encryption options for both transmission and storage.
 Flexibility in choosing encryption and authentication algorithms, for example, aespipe or
gpg.
 Backup of remote clients to a centralized location behind firewalls.
 Backup and recovery of clients running Security-Enhanced Linux (SELinux).
 Using best practices to write secure software