Introduction and

basic knowledge
of information
security
CS.521 INFORMATION AND NETWORK SECURITY
What is the purpose of security

 Security is one of the IT topic. IT is one of the method to drive

business. That means security is the one of method to drive
business
 Business > Security.
 CSO (Chief Security Officer) make decision what action should
do? Decision Based on Risk.
 Risk = Vulnerability x Threat x Asset.
Triage of Security

 Confidential

 Integrity

 Availability

 Accountability (Non-Repudiation)
Goal of Security

Prevention

Detection – Indicator of Compromise

Response
Goal of Attacking

Access Attack

Modification and repudiation

Denial of service (DOS) and
Distributed denial of service (DDOS)
Hacker?

Black Hat (Cracker)

White Hat

Gray Hat
Phase of Penetration Testing
 Pre-engagement Interactions
 Scope , Testing window, Contact information, “Get
out of jail free” card , Payment Terms
 Intelligence Gathering
 Information gathering phase

 Threat Modeling
 Plan to attack
Phase of Penetration Testing
 Vulnerability Analysis

 Vulnerability Scanning, Testing the surface

 Exploitation

 Post Exploitation
 Reporting

 Executive Report, Technical Report

Risk Assessment
 Asset

 Vulnerability

 Threat
Asset
 Hardware

 Software

 Information

 People
 Category Groups
Asset Computer Hardware
Computer Peripheral
Hardware
Electronics Devices
Networking Devices
Commercialized Software
Software
Internally Developed
Software
Physical Information Asset
Information Electronics Information Asset
Examples
Servers, Desktop, Laptops, Storage the end of
that period.
Printers, Scanner, Shredders
Computer protection equipment (Theft
protection equipment etc.) Telecom devices
(Phones, faxes, Smart Phones)
Routers, Hubs, Switches
Core processing applications, Desktop and
workstation office productivity software,
Operating system, network Devices OSI, Back
office and environment software (database
engines, back-up and storage management
software)
Financial Application, Personnel Application
Documents Hard Copies (Policies, Procedures),
DVDs, CDs, Backup Tape
Documents Soft Copies (Policies, Procedures),
Database, Configuration files, Passwords file,
Audit logs
Asset
Category Groups Examples
Security Admin, Network Admin, System
Internal Resources
People Admin, Operator
External Resources Third Party, Vendors Engineers, Consultants.
Asset Valuation
 Confidentiality

 Integrity

 Availability
Confidentiality
Integrity
Availability
Asset Value
Asset Value
Threats Level
Vulnerability Level
Risk Management
Mapping to Risk Level (MoR)
 The Risk level Scale will be from 1 to 125
Mapping to Risk Level (MoR)
 The Risk level Scale will be from 1 to 125
Homework
Watch the Hack Movies.
2001 2006 2007