816 resultados para Information Security
Resumo:
This paper describes the inception, planning and first delivery of a security course as part of a postgraduate ecommerce program. The course is reviewed in terms of existing literature on security courses, the common body of knowledge established for security professionals and the job market into which students will graduate. The course described in this paper is a core subject for the e-commerce program. This program was established in 1999 and the first batch of students graduated in 2001. The program is offered at both postgraduate and undergraduate level. The work described here relates to the postgraduate offering. Students on this program are graduates of diverse disciplines and do not have a common e-commerce or business background.
Resumo:
Information security is concerned with the protection of information, which can be stored, processed or transmitted within critical information systems of the organizations, against loss of confidentiality, integrity or availability. Protection measures to prevent these problems result through the implementation of controls at several dimensions: technical, administrative or physical. A vital objective for military organizations is to ensure superiority in contexts of information warfare and competitive intelligence. Therefore, the problem of information security in military organizations has been a topic of intensive work at both national and transnational levels, and extensive conceptual and standardization work is being produced. A current effort is therefore to develop automated decision support systems to assist military decision makers, at different levels in the command chain, to provide suitable control measures that can effectively deal with potential attacks and, at the same time, prevent, detect and contain vulnerabilities targeted at their information systems. The concept and processes of the Case-Based Reasoning (CBR) methodology outstandingly resembles classical military processes and doctrine, in particular the analysis of lessons learned and definition of modes of action. Therefore, the present paper addresses the modeling and design of a CBR system with two key objectives: to support an effective response in context of information security for military organizations; to allow for scenario planning and analysis for training and auditing processes.
Resumo:
There is no doubt about the necessity of protecting digital communication: Citizens are entrusting their most confidential and sensitive data to digital processing and communication, and so do governments, corporations, and armed forces. Digital communication networks are also an integral component of many critical infrastructures we are seriously depending on in our daily lives. Transportation services, financial services, energy grids, food production and distribution networks are only a few examples of such infrastructures. Protecting digital communication means protecting confidentiality and integrity by encrypting and authenticating its contents. But most digital communication is not secure today. Nevertheless, some of the most ardent problems could be solved with a more stringent use of current cryptographic technologies. Quite surprisingly, a new cryptographic primitive emerges from the ap-plication of quantum mechanics to information and communication theory: Quantum Key Distribution. QKD is difficult to understand, it is complex, technically challenging, and costly-yet it enables two parties to share a secret key for use in any subsequent cryptographic task, with an unprecedented long-term security. It is disputed, whether technically and economically fea-sible applications can be found. Our vision is, that despite technical difficulty and inherent limitations, Quantum Key Distribution has a great potential and fits well with other cryptographic primitives, enabling the development of highly secure new applications and services. In this thesis we take a structured approach to analyze the practical applicability of QKD and display several use cases of different complexity, for which it can be a technology of choice, either because of its unique forward security features, or because of its practicability.
Resumo:
EXECUTIVE SUMMARY : Evaluating Information Security Posture within an organization is becoming a very complex task. Currently, the evaluation and assessment of Information Security are commonly performed using frameworks, methodologies and standards which often consider the various aspects of security independently. Unfortunately this is ineffective because it does not take into consideration the necessity of having a global and systemic multidimensional approach to Information Security evaluation. At the same time the overall security level is globally considered to be only as strong as its weakest link. This thesis proposes a model aiming to holistically assess all dimensions of security in order to minimize the likelihood that a given threat will exploit the weakest link. A formalized structure taking into account all security elements is presented; this is based on a methodological evaluation framework in which Information Security is evaluated from a global perspective. This dissertation is divided into three parts. Part One: Information Security Evaluation issues consists of four chapters. Chapter 1 is an introduction to the purpose of this research purpose and the Model that will be proposed. In this chapter we raise some questions with respect to "traditional evaluation methods" as well as identifying the principal elements to be addressed in this direction. Then we introduce the baseline attributes of our model and set out the expected result of evaluations according to our model. Chapter 2 is focused on the definition of Information Security to be used as a reference point for our evaluation model. The inherent concepts of the contents of a holistic and baseline Information Security Program are defined. Based on this, the most common roots-of-trust in Information Security are identified. Chapter 3 focuses on an analysis of the difference and the relationship between the concepts of Information Risk and Security Management. Comparing these two concepts allows us to identify the most relevant elements to be included within our evaluation model, while clearing situating these two notions within a defined framework is of the utmost importance for the results that will be obtained from the evaluation process. Chapter 4 sets out our evaluation model and the way it addresses issues relating to the evaluation of Information Security. Within this Chapter the underlying concepts of assurance and trust are discussed. Based on these two concepts, the structure of the model is developed in order to provide an assurance related platform as well as three evaluation attributes: "assurance structure", "quality issues", and "requirements achievement". Issues relating to each of these evaluation attributes are analysed with reference to sources such as methodologies, standards and published research papers. Then the operation of the model is discussed. Assurance levels, quality levels and maturity levels are defined in order to perform the evaluation according to the model. Part Two: Implementation of the Information Security Assurance Assessment Model (ISAAM) according to the Information Security Domains consists of four chapters. This is the section where our evaluation model is put into a welldefined context with respect to the four pre-defined Information Security dimensions: the Organizational dimension, Functional dimension, Human dimension, and Legal dimension. Each Information Security dimension is discussed in a separate chapter. For each dimension, the following two-phase evaluation path is followed. The first phase concerns the identification of the elements which will constitute the basis of the evaluation: ? Identification of the key elements within the dimension; ? Identification of the Focus Areas for each dimension, consisting of the security issues identified for each dimension; ? Identification of the Specific Factors for each dimension, consisting of the security measures or control addressing the security issues identified for each dimension. The second phase concerns the evaluation of each Information Security dimension by: ? The implementation of the evaluation model, based on the elements identified for each dimension within the first phase, by identifying the security tasks, processes, procedures, and actions that should have been performed by the organization to reach the desired level of protection; ? The maturity model for each dimension as a basis for reliance on security. For each dimension we propose a generic maturity model that could be used by every organization in order to define its own security requirements. Part three of this dissertation contains the Final Remarks, Supporting Resources and Annexes. With reference to the objectives of our thesis, the Final Remarks briefly analyse whether these objectives were achieved and suggest directions for future related research. Supporting resources comprise the bibliographic resources that were used to elaborate and justify our approach. Annexes include all the relevant topics identified within the literature to illustrate certain aspects of our approach. Our Information Security evaluation model is based on and integrates different Information Security best practices, standards, methodologies and research expertise which can be combined in order to define an reliable categorization of Information Security. After the definition of terms and requirements, an evaluation process should be performed in order to obtain evidence that the Information Security within the organization in question is adequately managed. We have specifically integrated into our model the most useful elements of these sources of information in order to provide a generic model able to be implemented in all kinds of organizations. The value added by our evaluation model is that it is easy to implement and operate and answers concrete needs in terms of reliance upon an efficient and dynamic evaluation tool through a coherent evaluation system. On that basis, our model could be implemented internally within organizations, allowing them to govern better their Information Security. RSUM : Contexte gnral de la thse L'valuation de la scurit en gnral, et plus particulirement, celle de la scurit de l'information, est devenue pour les organisations non seulement une mission cruciale raliser, mais aussi de plus en plus complexe. A l'heure actuelle, cette valuation se base principalement sur des mthodologies, des bonnes pratiques, des normes ou des standards qui apprhendent sparment les diffrents aspects qui composent la scurit de l'information. Nous pensons que cette manire d'valuer la scurit est inefficiente, car elle ne tient pas compte de l'interaction des diffrentes dimensions et composantes de la scurit entre elles, bien qu'il soit admis depuis longtemps que le niveau de scurit globale d'une organisation est toujours celui du maillon le plus faible de la chane scuritaire. Nous avons identifi le besoin d'une approche globale, intgre, systmique et multidimensionnelle de l'valuation de la scurit de l'information. En effet, et c'est le point de dpart de notre thse, nous dmontrons que seule une prise en compte globale de la scurit permettra de rpondre aux exigences de scurit optimale ainsi qu'aux besoins de protection spcifiques d'une organisation. Ainsi, notre thse propose un nouveau paradigme d'valuation de la scurit afin de satisfaire aux besoins d'efficacit et d'efficience d'une organisation donne. Nous proposons alors un modle qui vise valuer d'une manire holistique toutes les dimensions de la scurit, afin de minimiser la probabilit qu'une menace potentielle puisse exploiter des vulnrabilits et engendrer des dommages directs ou indirects. Ce modle se base sur une structure formalise qui prend en compte tous les lments d'un systme ou programme de scurit. Ainsi, nous proposons un cadre mthodologique d'valuation qui considre la scurit de l'information partir d'une perspective globale. Structure de la thse et thmes abords Notre document est structur en trois parties. La premire intitule : La problmatique de l'valuation de la scurit de l'information est compose de quatre chapitres. Le chapitre 1 introduit l'objet de la recherche ainsi que les concepts de base du modle d'valuation propos. La manir traditionnelle de l'valuation de la scurit fait l'objet d'une analyse critique pour identifier les lments principaux et invariants prendre en compte dans notre approche holistique. Les lments de base de notre modle d'valuation ainsi que son fonctionnement attendu sont ensuite prsents pour pouvoir tracer les rsultats attendus de ce modle. Le chapitre 2 se focalise sur la dfinition de la notion de Scurit de l'Information. Il ne s'agit pas d'une redfinition de la notion de la scurit, mais d'une mise en perspectives des dimensions, critres, indicateurs utiliser comme base de rfrence, afin de dterminer l'objet de l'valuation qui sera utilis tout au long de notre travail. Les concepts inhrents de ce qui constitue le caractre holistique de la scurit ainsi que les lments constitutifs d'un niveau de rfrence de scurit sont dfinis en consquence. Ceci permet d'identifier ceux que nous avons dnomms les racines de confiance . Le chapitre 3 prsente et analyse la diffrence et les relations qui existent entre les processus de la Gestion des Risques et de la Gestion de la Scurit, afin d'identifier les lments constitutifs du cadre de protection inclure dans notre modle d'valuation. Le chapitre 4 est consacr la prsentation de notre modle d'valuation Information Security Assurance Assessment Model (ISAAM) et la manire dont il rpond aux exigences de l'valuation telle que nous les avons pralablement prsentes. Dans ce chapitre les concepts sous-jacents relatifs aux notions d'assurance et de confiance sont analyss. En se basant sur ces deux concepts, la structure du modle d'valuation est dveloppe pour obtenir une plateforme qui offre un certain niveau de garantie en s'appuyant sur trois attributs d'valuation, savoir : la structure de confiance , la qualit du processus , et la ralisation des exigences et des objectifs . Les problmatiques lies chacun de ces attributs d'valuation sont analyses en se basant sur l'tat de l'art de la recherche et de la littrature, sur les diffrentes mthodes existantes ainsi que sur les normes et les standards les plus courants dans le domaine de la scurit. Sur cette base, trois diffrents niveaux d'valuation sont construits, savoir : le niveau d'assurance, le niveau de qualit et le niveau de maturit qui constituent la base de l'valuation de l'tat global de la scurit d'une organisation. La deuxime partie: L'application du Modle d'valuation de l'assurance de la scurit de l'information par domaine de scurit est elle aussi compose de quatre chapitres. Le modle d'valuation dj construit et analys est, dans cette partie, mis dans un contexte spcifique selon les quatre dimensions prdfinies de scurit qui sont: la dimension Organisationnelle, la dimension Fonctionnelle, la dimension Humaine, et la dimension Lgale. Chacune de ces dimensions et son valuation spcifique fait l'objet d'un chapitre distinct. Pour chacune des dimensions, une valuation en deux phases est construite comme suit. La premire phase concerne l'identification des lments qui constituent la base de l'valuation: ? Identification des lments cls de l'valuation ; ? Identification des Focus Area pour chaque dimension qui reprsentent les problmatiques se trouvant dans la dimension ; ? Identification des Specific Factors pour chaque Focus Area qui reprsentent les mesures de scurit et de contrle qui contribuent rsoudre ou diminuer les impacts des risques. La deuxime phase concerne l'valuation de chaque dimension prcdemment prsentes. Elle est constitue d'une part, de l'implmentation du modle gnral d'valuation la dimension concerne en : ? Se basant sur les lments spcifis lors de la premire phase ; ? Identifiant les taches scuritaires spcifiques, les processus, les procdures qui auraient d tre effectus pour atteindre le niveau de protection souhait. D'autre part, l'valuation de chaque dimension est complte par la proposition d'un modle de maturit spcifique chaque dimension, qui est considrer comme une base de rfrence pour le niveau global de scurit. Pour chaque dimension nous proposons un modle de maturit gnrique qui peut tre utilis par chaque organisation, afin de spcifier ses propres exigences en matire de scurit. Cela constitue une innovation dans le domaine de l'valuation, que nous justifions pour chaque dimension et dont nous mettons systmatiquement en avant la plus value apporte. La troisime partie de notre document est relative la validation globale de notre proposition et contient en guise de conclusion, une mise en perspective critique de notre travail et des remarques finales. Cette dernire partie est complte par une bibliographie et des annexes. Notre modle d'valuation de la scurit intgre et se base sur de nombreuses sources d'expertise, telles que les bonnes pratiques, les normes, les standards, les mthodes et l'expertise de la recherche scientifique du domaine. Notre proposition constructive rpond un vritable problme non encore rsolu, auquel doivent faire face toutes les organisations, indpendamment de la taille et du profil. Cela permettrait ces dernires de spcifier leurs exigences particulires en matire du niveau de scurit satisfaire, d'instancier un processus d'valuation spcifique leurs besoins afin qu'elles puissent s'assurer que leur scurit de l'information soit gre d'une manire approprie, offrant ainsi un certain niveau de confiance dans le degr de protection fourni. Nous avons intgr dans notre modle le meilleur du savoir faire, de l'exprience et de l'expertise disponible actuellement au niveau international, dans le but de fournir un modle d'valuation simple, gnrique et applicable un grand nombre d'organisations publiques ou prives. La valeur ajoute de notre modle d'valuation rside prcisment dans le fait qu'il est suffisamment gnrique et facile implmenter tout en apportant des rponses sur les besoins concrets des organisations. Ainsi notre proposition constitue un outil d'valuation fiable, efficient et dynamique dcoulant d'une approche d'valuation cohrente. De ce fait, notre systme d'valuation peut tre implment l'interne par l'entreprise elle-mme, sans recourir des ressources supplmentaires et lui donne galement ainsi la possibilit de mieux gouverner sa scurit de l'information.
Resumo:
Mode of access: Internet.
Resumo:
Cover title.
