Lecture Notes - INFORMATION SECURITY

LECTURE NOTES:

INFORMATION
SECURITY

AN AUGMENTED REALITY EXPERIENCED

PREPARED BY:
JACEY D/O MARIADASS
NORHASLINDA BINTI ABDUL KARIM



INFORMATION
SECURITY

LECTURE NOTES - INFORMATION SECURITY

TERBITAN EDISI 2020

BUKU “LECTURE NOTES - INFORMATION SECURITY” ADALAH SEBAGAI
RUJUKAN DAN BACAAN UMUM TERUTAMA KEPADA PENSYARAH DAN
P E L A JA R POLITEKNIK DAN KOLEJ KOMUNITI MALAYSIA BAGI
MENGAPLIKASIKAN AMALAN TERBAIK DALAM PERLAKSANAAN KAEDAH
PENGAJARAN DAN PEMBELAJARAN BERKONSEPKAN TEKNOLOGI
AUGMENTED REALITY.

EDITOR
MOHD ROZAIMIN ABDUL HAMID

PENULIS
JACEY D/O MARIADASS
NORHASLINDA BINTI ABDUL KARIM

DITERBITKAN OLEH
UNIT PEMBELAJARAN DIGITAL
BAHAGIAN INSTRUKSIONAL DAN PEMBELAJARAN DIGITAL
JABATAN PENDIDIKAN POLITEKNIK DAN KOLEJ KOMUNITI ARAS 6, GALERIA PJH,
JALAN P4W, PERSIARAN PERDANA, PRESINT 4,
62100 PUTRAJAYA

Website : www.celt.edu.my
E- mail : [email protected]



CONTENT

1.0 INTRODUCTION TO INFORMATION SECURITY
1.1 DEFINTION OF INFORMATION SECURITY
1.1.1 AREAS IN INFORMATION SECURITY
1.1.2 GOALS OF INFORMATION SECURITY
1.2 INTERNET SERVICES AND CURRENT ISSUES
1.2.1 IMPORTANT TERMINOLOGIES
1.2.2 SECURITY THREATS

2.0 NETWORK ENVIRONMENT
2.1 NETWORK ENVIRONMENT
2.2 TCP/IP SUITE PROTOCOL
2.2.1 PROBLEM RELATED TO TCP
2.2.2 IP DATAGRAM
2.2.3 MODES IN ENCAPSULATING SECURITY PAYLOAD (ESP)

3.0 WEB AND APPLICATION SECURITY
3.1 APPLICATION SECURITY
3.1.1 APPLICATION THREATS AND COUNTERMEASURES
3.1.2 THREAT MODELLING FOR WEB APPLICATIONS
3.2 WEB SECURITY
3.2.1 COMMON SECURITY THREATS ON WEB
3.3 E-MAIL SECURITY
3.3.1 PROCEDURE TO SEND E-MAIL
3.3.2 E-MAIL ENCRYPTION AND AUTHENTICATION

4.0 AUTHENTICATION – ENCRYPTION, CRYPTOGRAPHY AND DIGITAL SIGNATURES
4.1 DEFINITION OF AUTHENTICATION
4.1.1 AUTHENTICATIOJ TECHNOLOGIES
4.1.2 ATTACKS THAT CAN BE LAUNCED IF AUTHENTICATION IS NOT
IMPLEMENTED
4.2 ENCRYPTION SCHEME
4.3 DIGITAL SIGNATURES
4.4 CRYPTOGRAPHIC TERMINOLOGIES

5.0 DISASTER PREVENTION AND RECOVERY
5.1 DISASTER AND ITS CATEGORIES
5.1.1 TWO CATEGORIES OF DISASTER SOLUTIONS
5.1.2 PURPOSE OF DISASTER RECOVERY PLAN
5.2 HARDWARE FOR DISASTER HANDLING
5.3 RISK ANALYSIS
5.3.1 ELEMENT IN RISK ANALYSIS
5.3.2 RISK MANAGEMENT PROCESS

SYNOPSIS

INFORMATION SECURITY course provides a foundation in the basic Information
Security (IS) knowledge and skills necessary for ICT professionals. Students
are exposed to the principles and good practices in environmentally sustainable
secured computing and the use of appropriate tools and technologies in
managing IS environment.

SUMMARY OF EACH TOPICS

TOPIC 1: INTRODUCTION TO INFORMATION SECURITY
This topic introduces the need of information security, information security
organizations and issues of on-line security. Students are introduced to identifying
potential risks to network security.

TOPIC 2: NETWORK ENVIRONMENT
This topic introduces the fundamentals of network and protocol involve. It
discusses on the various protocols and standards such as Domain name Server
Security (DNSSEC), Generic Security Services API (GSSAPI), Secure Sockets
Layer (SSL), Secure Hypertext Transfer Protocol (SHTTP), Security Tokens,
BlackDuck and OpenLogic.

TOPIC 3: WEB AND APPLICATION SECURITY
This topic introduces the application threats and their countermeasures, and
common security threats on web. The topic discus Common Gateway Interface
(CGI) in retrieving the external programs through information server. This topic
also covers Electronic Mail (e-mail), the common e-mail protocol and risk related
to e-mail security.

TOPIC 4: AUTHENTICATION – ENCRYPTION, CRYPTOGRAPHY AND
DIGITAL SIGNATURES
This topic deals with authentication, cryptography processes and digital
signature technology in securing a communication session. It discusses on the
various methods of encryption and covers the solutions available in providing
authentication and encryption services.

TOPIC 5: DISASTER PREVENTION AND RECOVERY
This topic covers disaster prevention and recovery process which includes
managing hardware for disasters handling.

INFORMATION SECURITY

1.0 INTRODUCTION TO
INFORMATION SECURITY

1.1 Definition of Information Security

1.1.1 Areas in Information Security
A successful organization should have the following multiple layers of security in
place to protect its operations:

1

INFORMATION SECURITY

1.1.2 Goals of Information Security [CIA]

2

INFORMATION SECURITY

1.2 Internet Services and the Current Issues

a. Electronic Mail
Using regular emails to send mission-critical files means that sensitive data is communicated
through a vulnerable platform. Not only is the data stored on your mail providers’ servers,
where it can later be compromised, but there’s always a risk that an email will be sent to the
wrong recipient.

b. File transfer
FTP is not a secure method for transferring important data. It doesn’t encrypt user credentials.
It means that data is sent in the clear. That means your files, including important sign-on
information, can be sniffed and stolen during transit.

c. Remote Access to hosts
Remote access is simply the ability to access a computer or network, at home or in an office,
from a remote location. Some organization give permission to their staff to use their own
personal computers for work. If your employees access your network remotely from their
laptop, they will increase the risks of your system being hacked.

d. Real time conferencing services
Many firms have been taking advantage of technology to conduct videoconferencing using
Internet protocols (IP) these days. They can communicate in real-time with offices and clients
in remote locations, saving a lot in travel expenses. However, there are certain security risks
associated with videoconferencing that must be addressed. Security threats involve the
possibility of someone hacking the video conference with “denial of service” attacks, viruses,
and other issues.

1.2.1 Important Terminologies

3

INFORMATION SECURITY

1.2.2 Security Threats
a. Categories: data disclosure, data modification, data availability
b. Activities: hacking, cracking, spoofing, sniffing

4

INFORMATION SECURITY

Hacking versus Cracking

5

INFORMATION SECURITY

2.0 NETWORK ENVIRONMENT

2.1 Network Environment

6

INFORMATION SECURITY

2.2 TCP/IP Suite Protocol

TCP / IP stands for Transmission Control Protocol / Internet Protocol, the suite of communication
protocols used to connect host on the Internet. The TCP/IP protocol suite uses a 4-layer model.
TCP/IP model is a practical implementation where else the Open Systems Interconnection
(OSI) model is an idealized networking model. TCP/IP is a de facto standard on the Internet
and has become the protocol of choice on LANs and WANs. Figure 2.2 shows how the TCP/
IP and OSI models are compared. TCP/IP was designed to be independent of networking
hardware and should run across any connection media.

Figure 2.1: OSI and TCP/IP Protocol Stacks and Protocols

7

INFORMATION SECURITY

TCP depends on IP to move packets around the network on its behalf. TCP is a Connection-
Oriented Acknowledged Transport protocol. TCP is a transport layer protocol used by
applications that require guarantee delivery.

Figure 2.2: Three Way Handshake
Figure 2.2 shows The TCP three-way handshake in Transmission Control Protocol (also called
the TCP-handshake: SYN, SYN-ACK, ACK). It is the method used by TCP set up a TCP/IP
connection over an Internet Protocol based network. The name three way handshakes are
given because there are three messages transmitted by TCP to negotiate and start a TCP
session between two computers.
2.2.1 Problem Related to TCP

8

INFORMATION SECURITY

2.2.2 IP Datagram
Packets in the network (internet) layer are called datagrams. A datagram is a variable-length
packet consisting of two parts: header and data. The header is 20 to 60 bytes in length and
contains information essential to routing and delivery. Figure 2.3 shows information related
to IP datagram.

Figure 2.3: IP datagram
Maximum size of IP datagram is 65535, but the data link layer protocol generally imposes a
limit that is much smaller.
Example:
Ethernet frames have a maximum payload of 1500 bytes

- IP datagrams encapsulated in Ethernet frame cannot be longer than 1500 bytes
a. Maximum Transfer Unit (MTU)
The limit on the maximum IP datagram size, imposed by the data link protocol is called
maximum transmission unit (MTU).

9

INFORMATION SECURITY

b. Fragmentation

Example of Fragmentation:
A datagram with size 2440 bytes must be fragmented according to an MTU limit of 1000
bytes.

10

INFORMATION SECURITY

c. Encapsulation
In networking model, the terms encapsulation and de-encapsulation refer to a process in
which protocol information is added to the data and removed from the data when it passes
through the layers. When data moves from upper layer to lower level of TCP/IP protocol
stack (outgoing transmission) each layer includes a bundle of relevant information called a
header along with the actual data. Protocol information can be added before and after the
data. If information is added before the data, it is known as header. If information is added
after the data, it is known as trailer.
The data package containing the header and the data from the upper layer then becomes
the data that is repackaged at the next lower level with lower layer's header.
Header is the supplemental data placed at the beginning of a block of data when it is
transmitted.
This supplemental data is used at the receiving side to extract the data from the
encapsulated data packet. This packing of data at each layer is known as data
encapsulation.

Figure 2.4: Encapsulation and De-Encapsulation Process

Figure 2.4 shows the process of encapsulation and de-encapsulation. Header and trailer
added by a layer in the sending computer can be removed only by the peer layer in the
receiving computer. For example, header and trailer added by the transport layer in the
sending computer can be removed only by the transport layer in the receiving computer.

11

INFORMATION SECURITY

2.2.3 Modes in Encapsulating Security Payload (ESP)
An Encapsulating Security Payload (ESP) is a protocol within the IPsec for providing
authentication, integrity and confidentially of network packets data/payload in IPv4 and IPv6
networks.
Two modes in ESP:
(i) Tunnel mode
In tunnel mode, the entire IP packet is encrypted and/or authenticated. It is then
encapsulated into a new IP packet with a new IP header. Tunnel mode is used to create
virtual private networks for network-to-network communications (e.g. between routers to
link sites), host-to-network communications (e.g. remote user access) and host-to-host
communications (e.g. private chat).
(ii) Transport mode ESP
In transport mode, only the payload of the IP packet is usually encrypted and/or
authenticated. The routing is intact, since the IP header is neither modified nor encrypted;
however, when the authentication header is used, the IP addresses cannot be translated,
as this will invalidate the hash value. The transport and application layers are always
secured by hash, so they cannot be modified in any way.

12

INFORMATION SECURITY

3.0 WEB AND APPLICATION SECURITY

3.1 Application Security

Application security is the process of developing, adding and testing security
features within applications to prevent security vulnerabilities against threats such
as unauthorized access and modification.
3.1.1 Application Threats and Countermeasures

Figure 3.1: Category of Application Threats
Figure 3.1 shows the category of application threats. Input validation, authentication
and authorization are very important for any web application. Input validation
includes any kind of false presumption regarding the inputs provided by the ignorant
user. It involves the type, range or format of input data. The most important features
to secure web application are authentication and authorization. Authentication
is important in order to ensure that a legitimate user can access the application.
Authorization is also important to allow users to access a specific resource or
service. These entire categories are important because without control to access
any web application will cause to threats. Malicious users will try to access your
web application without your consent. Therefore, you should implement the
necessary security features to protect yourself from new web application threats.
Due to that, you need to know about threats and countermeasure in order to secure
web application since security is often defined as a negative property. A system is
perfectly secure whenever there is no possible way to attack it. In order to assess
the security of a system, we must therefore look at all the possible threats. The
STRIDE model is a useful tool to help us classify threats.

13

INFORMATION SECURITY

Table 3.1 shows the threats and countermeasure according to STRIDE model.

Table 3.1: STRIDE Model

14

INFORMATION SECURITY

Table 3.2 shows application threats and countermeasure. By understanding STRIDE, it is
more effective when applying countermeasures. You need to understand common threats
because it can be prevented from compromising the application.

Table 3.2: Application Threats and Countermeasure

SQL Injection

15

INFORMATION SECURITY

DDos Attack

Encrypted Message

16

INFORMATION SECURITY

Cross Side
3.1.2 Threat Modeling for Web Applications
Threat Modeling is an approach for analyzing the security of an application before coding. It
enables you to identify, mitigate and prioritize your threats. When building a threat model it
is critically important to include:

- People who are building the system
- People who are testing the system
- People who understand the business goals of the system
- Cyber Security Advisors
We need to concern about web application security mechanisms so that we can develop a
secure web application. Table 3.3 shows the web application security mechanisms for better
understanding.

17

INFORMATION SECURITY

Table 3.3: Web Application Security Mechanisms
Figure 3.2 shows threat modeling. Threat modeling is a repeatable process that helps you
find and mitigate all of the threats to your product.

Figure 3.2: Threat Modeling

18

INFORMATION SECURITY

3.2 Web Security

Web security involves protecting website or web application by detecting, preventing
and responding to attacks. Websites and web applications are just as prone to security
breaches as physical homes, stores and government locations.

3.2.1 Common Security Threats on Web

i) Threats on the Client Server
- Many computers on the client side are vulnerable to attacks like viruses, worms,

Trojan horses and so on that is created by hackers, crackers or due to malicious
codes.

ii) Threats on the Server Side
- Data available on web servers is exposed to unauthorized access.
- If an intrusion occurs on the web server, it could lead to reduction in speed or it might
crash the server.

iii) Network Threats
- If a network on the web is not properly secured, it might be the root cause for loss of
information.
- If the network is weak, then data transferred from the source system to the
destination system can be easily altered.
- Hackers usually attack network that are not properly secured and can steal the
resources of the computer.

3.3 E-mail Security

Email security refers to the collective measures used to secure the access and content of
an email account or service. It allows an individual or organization to protect the overall
access to one or more email addresses or accounts.

Email is often used to spread malware, spam and phishing attacks. Attackers use deceptive
messages to entice recipients to part with sensitive information, open attachments or click
on hyperlinks that install malware on the victim’s device. Email is also a common entry
point for attackers looking to gain a foothold in an enterprise network and obtain valuable
company data.

19

INFORMATION SECURITY

3.3.1 Procedure to Send E-mail

20

INFORMATION SECURITY

Figure 3.3: How e-mail Appears to Work
MUA: Mail User Agent MTA: Mail Transfer Agent MDA: Mail Delivery Agent
Figure 3.3 shows how e-mail really works. Email was designed to be as open and
accessible as possible. It allows people in organizations to communicate with each other
and with people in other organizations. The problem is that email is not secure. This
allows attackers to use email as a way to cause problems in attempt to profit. Whether
through spam campaigns, malware and phishing attacks, sophisticated targeted attacks, or
business email compromise (BEC), attackers try to take advantage of the lack of security
of email to carry out their actions. Since most organizations rely on email to do business,
attackers exploit email in an attempt to steal sensitive information.
Because email is an open format, it can be viewed by anyone who can intercept it. This
became an issue as organizations began sending confidential or sensitive information
through email. An attacker could easily read the contents of an email by intercepting it. Over
the years, organizations have been increasing email security measures to make it difficult
for attackers to get their hands on sensitive or confidential information.
3.3.2 E-mail Encryption and Authentication
In today’s world, it is important to deploy an automated email encryption solution as a best
practice. This solution should be able to analyze all outbound email traffic to determine
whether the material is sensitive. If the content is sensitive, it needs to be encrypted before
it is emailed to the intended recipient. This will prevent attackers from viewing emails, even
if they were to intercept them. Email encryption often includes authentication. Figure 3.4
shows automated e-mail encryption.

Figure 3.4: Automated E-Mail Encryption

21

INFORMATION SECURITY

4.0 AUTHENTICATION – ENCRYPTION,
CRYPTOGRAPHY AND DIGITAL
SIGNATURES

4.1 Definition of Authentication

Authentication is the process of determining whether someone or something is, in
fact, who or what it declares itself to be. Authentication technology provides access
control for systems by checking to see if a user's credentials match the credentials
in a database of authorized users or in a data authentication server.
4.1.1 Authentication Technologies
There are four main types of Technologies for authentication:

1. Password based authentication technologies
Passwords are the most common form of authentication. Password may be of
any form (String of alphabets, numbers and special characters). This password is
necessarily to be known by the ENTITY or the THING or a PERSON that is being
Authenticated.
This authentication Process takes places (password) by:

- Prompts for user id and password.
- User enters user id and password.
- User id and password validation.
- Authentication result back to the server.
- Inform user accordingly.

22

INFORMATION SECURITY

2. Certificate based authentication technologies

It is a digital document which digitally signed by a reliable third party known as the
Certificate Authority (CA). These Digital Certificates can be reused for user authentication.
Certificate based authentication is stable as compared to password based authentication,
because here end user is supposed to HAVE something(CERTIFICATE) rather than to
KNOW something(PASSWORD). Electronic document contains information of the entity
it belongs to, the entity it was issued by, unique serial number or some other unique
identification, valid date and digital fingerprint.

Figure 4.1: Example Flow During Certificate-Based Mutual Authentication

3. E-Token based authentication technologies

An E-Token authentication is a small device that develop/generates a new odd/random
value every time it is used. This random value becomes the basis for authentication (an
alternative to a password). It can be implemented on a USB key fob or on a smart card.
Data is protected on the device itself. It may store credentials such as passwords, digital
signatures and certificates, and private keys. E-Token has different components or features
like processor, LCD for displaying outputs or random values, battery, small keypad for
entering information, real-time clock and others.

Here's example how the process works: 1.The user enters their username and
password.
2. The server verifies that the login information
is correct and generates a secure, signed
token for that user at that particular time.
3. The token is sent back to the user’s
browser and stored there.
4. When the user needs to access something
new on the server, the system decodes and
verifies the attached token. A match allows the
user to proceed.
5. Once the user logs out of the server, the
token is destroyed.

23

INFORMATION SECURITY

4. Biometric based authentication technologies

Biometric authentication mention to the realization/recognition/identification of humans
by their personality/characteristics such as Face, fingerprint, human voice, Retina, Iris
pattern of the eye, vein pattern etc. It's used in computer science as a form of realization/
recognition and access control. It is also used to find/select persons in groups that are
under consideration/measurement.
4.1.2 Attacks that can be Launched if Authentication is Not Implemented

24

INFORMATION SECURITY

4.2 Encryption Scheme

Definition of Encryption
Encryption is a way of scrambling data so that only authorized parties can understand the
information. In technical terms, it is the process of converting plaintext to ciphertext. In
simpler terms, encryption takes readable data and alters it so that it appears random.

Two classes of key-based encryption algorithms:
- Symmetric algorithms
- Asymmetric algorithms

Table 4.1: Differences Between Symmetric and Asymmetric

25

INFORMATION SECURITY

4.3 Digital Signatures

Digital signatures are like electronic “fingerprints.” In the form of a coded message, the
digital signature securely associates a signer with a document in a recorded transaction.
Digital signatures use a standard, accepted format, called Public Key Infrastructure (PKI), to
provide the highest levels of security and universal acceptance.

Digital Signature is a process that guarantees that the contents of a message have not
been altered in transit. When you, the server, digitally sign a document, you add a one-way
hash (encryption) of the message content using your public and private key pair.

Your client can still read it, but the process creates a "signature" that only the server's public
key can decrypt. The client, using the server's public key, can then validate the sender as
well as the integrity of message contents. Figure 4.2 digital signature process.

Signer authentication Data integrity Non - Repudiation

Proof of who actually signed Proof that the document The signer should not be
the document i.e. digital has not been changed since able to falsely deny having
signing. The digital signature signed. That is, it should be
signatures linking the user’s depends on every binary bit of possible to prove in a court
signature to an actual the document and therefore that the signer in fact created
identifiable entity. can’t be re-attached to any the signature. Conversely
it should not be possible to
other document. falsely claim that someone
signed a document when they

did not.

Figure 4.2: Digital Signature Process

26

INFORMATION SECURITY

4.4 Cryptographic Terminologies

Message authentication is to protect the message integrity and to perform sender
authentication. In cryptography, a message authentication code (MAC), sometimes known as
a tag, is a short piece of information used to authenticate a message in other words, to
confirm that the message came from the stated sender (its authenticity) and has not been
changed. The MAC value protects both a message's data integrity as well as its authenticity,
by allowing verifiers (who also possess the secret key) to detect any changes to the message
content.

27

INFORMATION SECURITY

5.0 DISASTER AND PREVENTION
RECOVERY

5.1 Disaster and its Categories

Disasters can be classified broadly in two types; natural disasters and man-made
disasters as below

5.1.1 Two Categories of Disaster Solutions
Two categories of disaster solution are:

i. Maintaining or restoring a service.
ii. Protecting or restoring the lost, corrupted, or deleted information
• Disaster recovery principles
Recovery is part of emergency management, which includes the broader
components of prevention, preparedness, and response. It includes built,
environmental and economic elements, as well as social wellbeing. Recovery
can provide an opportunity to improve these aspects beyond previous conditions,
by enhancing social and natural environments, infrastructure and economies
– contributing to a more resilient community. There are a few key principles in
designing systems for high availability and rapid disaster recovery:
- Design redundancy into all hardware systems to minimize the effects of

failures and disasters.

28

INFORMATION SECURITY

- Plan backups so that backup data is always readily and quickly available. Live
mirroring to disk provides the highest level of backup safety and the fastest recovery.

- Maintaining redundant hardware and backups off site guards against disasters at
your primary site.

• Types of disaster recovery system

In the event of a disaster, every business must have a set of recovery strategies in place to
protect and restore mission-critical processes as soon as possible. Hence, there arises a
need for remote replication which implies sending business-critical data offsite for reliable
storage and fast recovery. Two main types of disaster recovery system are Synchronous
system and Asynchronous system.

When an I/O request is initiated by any
application on the primary system, that request
is sent to the backup disk systems first and
committed there. The system then waits for the
confirmation of that commit to return from the
backup disk systems. Only then is the I/O
committed to the primary disk systems. This
ensures that nothing can be committed to the
primary system unless it already exists on the
backup.

These systems are generally software-based
and reside on the host server rather than
on the attached storage array. They
can protect both local and attached
disk systems. In an asynchronous system,
I/O requests are committed to the primary disk
systems immediately while a copy of that I/O
is sent via some medium (usually TCP/IP)
to the backup disk systems. Since there
is no waiting for the commit signal from the
remote systems, these systems can send a continuous stream of I/O data to the backup
systems without slowing down I/O response time on the primary system.

29

INFORMATION SECURITY

Table 5.1: Differences between Synchronous and Asynchronous

30

INFORMATION SECURITY

5.1.2 Purpose of Disaster Recovery Plan

Disaster Recovery Planning

- Planning
Although there is no one-size-fits-all plan, there are three basic strategies: prevention,
including proper backups, having surge protectors and generators
detection, a byproduct of routine inspections, which may discover new (potential) threats
correction. The latter may include securing proper insurance policies, and holding a
"lessons learned" brainstorming session.

- Program Budget
To get started, begin by identifying your large-expense items, such as offsite storage
facilities, salaries, rent, utilities, hardware and software maintenance, travel and outside
consulting. Plan should create assumptions, especially for major expense items, and review
these assumptions once the budget has been completed.

- Organizing
An outline of the plan’s contents should be prepared to guide the development of the
detailed procedures. Top management should review and approve the proposed plan. The
outline can ultimately be used for the table of contents after final revision. The procedures
should include methods for maintaining and updating the plan to reflect any significant
internal, external or systems changes. The procedures should allow for a regular review of
the plan by key personnel within the organization.

- Training
To develop an effective plan, all departments should be involved. Within all departments
the critical needs should be identified. Critical needs include all information and equipment
needed in order to continue operations should a department be destroyed or become
inaccessible. All of the team must be have a training program based on disaster recovery
plan.

- Implementation
Once the disaster recovery plan has been written and tested, the plan should be approved
by top management. It is top management’s ultimate responsibility that the organization has
a documented and tested plan.

31

INFORMATION SECURITY

5.2 Hardware for Disaster Handling

Information technology systems require hardware, software, data and connectivity. Without
one component of the “system,” the system may not run. Therefore, hardware for disaster
handling need to be identified in order to anticipate the disruption of service. Figure 5.1
shows hardware for disaster handling.

Figure 5.1: Hardware for Disasters Handling

5.3 Risk Analysis

Risk analysis is the process of identifying and analyzing potential issues that could
negatively impact key business
5.3.1 Element in Risk Analysis
To carry out a Risk Analysis, first identify the possible threats that you face, and then
estimate the likelihood that these threats will materialize. Figure 5.2 shows element in risk
analysis. Risk Analysis can be complex, as you'll need to draw on detailed information such
as project plans, financial data, security protocols, marketing forecasts, and other relevant
information. However, it's an essential planning tool, and one that could save time, money,
and reputations.

Figure 5.2: Element in Risk Analysis

32

INFORMATION SECURITY

5.3.2 Risk Management Process

Risk management process is defined as the process of identifying, monitoring and
managing potential risks in order to minimize the negative impact they may have on an
organization. Examples of potential risks include security breaches, data loss, cyber-
attacks, system failures and natural disasters. An effective risk management process will
help identify which risks pose the biggest threat to an organization and provide guidelines
for handling them. Figure 5.3 shows Risk Management Process.

Figure 5.3: Risk Management Process

Process 1: IDENTIFY risks faced by the organization – both opportunities (positive
risks) and threats (negative risks).

Process 2. Some risks are avoidable if you simply don’t engage in an activity.

AVOID projects and actions that would trigger risks you don’t want to face.

Process 3: Some risks are opportunities. DEVELOP opportunities that may be of
strategic value.

Those three steps identify threats and opportunities, rule out some actions as just too risky,
and position new initiatives for testing. But what do we do with those threats we can’t avoid,
as well as the potential negatives that may result from new initiatives? That’s addressed in
the next three steps:

Process 4: REDUCE the threats presented by ongoing operations and strategic
initiatives by identifying and implementing specific mitigation efforts.

Process 5: SHIFT threats that cannot be mitigated, using insurance, contracts, joint
ventures, etc.

Process 6: ACCEPT the remaining risks, having taken the reasonable steps outlined
above.

Finally, risk management is not a one-and-done activity. Instead, it builds and improves over
time:
Process 7: IMPROVE your risk management over time by making Steps 1 through 6

an ongoing process and regular part of your operations.

33

INFORMATION SECURITY
34