Information security

Table of contents

• General concepts
• Access control
• Security management
• Regulatory compliance
• Operation security
• Network security
• Application security
• Cryptography

General concepts

Untitled Slide

Untitled Slide

Plan - Establish the goals, objectives and processes.
Do - Implement the plan and execute the process.
Check - Study the actual results and compare against the expected results
Act - Make improvement when necessary, go back to plan

security management

Untitled Slide

access control

Access control is all about managing how subjects interact with objects in authorized manner.

Subjects are the entities obtain or alter data, for example:
user, computer, program, process
and so on

Objects are the entities provide or host data, for example:
files, database, media, printer
and so on

Access control principles

• Separation of Duties
• Least privilege
• Need to know
• Compartmentalization

Separation of Duties is aimed for preventing frauds and errors by distributing tasks and privileges (of a process) to multiple people

Least privilege is required for a subject to have no more access privilege than necessary for performing tasks, jobs or functions

Need to know is used to define how much access privilege is needed (to know) based on job functions

Compartmentalization is process of separating groups of people and isolating flow of information between them

Untitled Slide

regulatory compliance

Untitled Slide

operation security

Untitled Slide

network security

Untitled Slide

application security

Untitled Slide

cryptography

Untitled Slide