fbpx
Wikipedia

Information security

March 16, 2023

Information security, sometimes shortened to InfoSec,[1] is the practice of protecting information by mitigating information risks. It is part of information risk management.[2][3] It typically involves preventing or reducing the probability of unauthorized/inappropriate access to data, or the unlawful use, disclosure, disruption, deletion, corruption, modification, inspection, recording, or devaluation of information.[4] It also involves actions intended to reduce the adverse impacts of such incidents. Protected information may take any form, e.g. electronic or physical, tangible (e.g. paperwork) or intangible (e.g. knowledge).[5][6] Information security's primary focus is the balanced protection of the confidentiality, integrity, and availability of data (also known as the CIA triad) while maintaining a focus on efficient policy implementation, all without hampering organization productivity.[7] This is largely achieved through a structured risk management process that involves:

  • identifying information and related assets, plus potential threats, vulnerabilities, and impacts;
  • evaluating the risks
  • deciding how to address or treat the risks i.e. to avoid, mitigate, share or accept them
  • where risk mitigation is required, selecting or designing appropriate security controls and implementing them
  • monitoring the activities, making adjustments as necessary to address any issues, changes and improvement opportunities[8]

To standardize this discipline, academics and professionals collaborate to offer guidance, policies, and industry standards on password, antivirus software, firewall, encryption software, legal liability, security awareness and training, and so forth.[9] This standardization may be further driven by a wide variety of laws and regulations that affect how data is accessed, processed, stored, transferred and destroyed.[10] However, the implementation of any standards and guidance within an entity may have limited effect if a culture of continual improvement isn't adopted.[11]

Definition

 
Information Security Attributes: or qualities, i.e., Confidentiality, Integrity and Availability (CIA). Information Systems are composed in three main portions, hardware, software and communications with the purpose to help identify and apply information security industry standards, as mechanisms of protection and prevention, at three levels or layers: physical, personal and organizational. Essentially, procedures or policies are implemented to tell administrators, users and operators how to use products to ensure information security within the organizations.[12]

Various definitions of information security are suggested below, summarized from different sources:

  1. "Preservation of confidentiality, integrity and availability of information. Note: In addition, other properties, such as authenticity, accountability, non-repudiation and reliability can also be involved." (ISO/IEC 27000:2009)[13]
  2. "The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability." (CNSS, 2010)[14]
  3. "Ensures that only authorized users (confidentiality) have access to accurate and complete information (integrity) when required (availability)." (ISACA, 2008)[15]
  4. "Information Security is the process of protecting the intellectual property of an organisation." (Pipkin, 2000)[16]
  5. "...information security is a risk management discipline, whose job is to manage the cost of information risk to the business." (McDermott and Geer, 2001)[17]
  6. "A well-informed sense of assurance that information risks and controls are in balance." (Anderson, J., 2003)[18]
  7. "Information security is the protection of information and minimizes the risk of exposing information to unauthorized parties." (Venter and Eloff, 2003)[19]
  8. "Information Security is a multidisciplinary area of study and professional activity which is concerned with the development and implementation of security mechanisms of all available types (technical, organizational, human-oriented and legal) in order to keep information in all its locations (within and outside the organization's perimeter) and, consequently, information systems, where information is created, processed, stored, transmitted and destroyed, free from threats.[20] Threats to information and information systems may be categorized and a corresponding security goal may be defined for each category of threats.[21] A set of security goals, identified as a result of a threat analysis, should be revised periodically to ensure its adequacy and conformance with the evolving environment.[22] The currently relevant set of security goals may include: confidentiality, integrity, availability, privacy, authenticity & trustworthiness, non-repudiation, accountability and auditability." (Cherdantseva and Hilton, 2013)[12]
  9. Information and information resource security using telecommunication system or devices means protecting information, information systems or books from unauthorized access, damage, theft, or destruction (Kurose and Ross, 2010).[23]

Overview

At the core of information security is information assurance, the act of maintaining the confidentiality, integrity, and availability (CIA) of information, ensuring that information is not compromised in any way when critical issues arise.[24] These issues include but are not limited to natural disasters, computer/server malfunction, and physical theft. While paper-based business operations are still prevalent, requiring their own set of information security practices, enterprise digital initiatives are increasingly being emphasized,[25][26] with information assurance now typically being dealt with by information technology (IT) security specialists. These specialists apply information security to technology (most often some form of computer system). It is worthwhile to note that a computer does not necessarily mean a home desktop.[27] A computer is any device with a processor and some memory. Such devices can range from non-networked standalone devices as simple as calculators, to networked mobile computing devices such as smartphones and tablet computers.[28] IT security specialists are almost always found in any major enterprise/establishment due to the nature and value of the data within larger businesses.[29] They are responsible for keeping all of the technology within the company secure from malicious cyber attacks that often attempt to acquire critical private information or gain control of the internal systems.[30][31]

The field of information security has grown and evolved significantly in recent years.[32] It offers many areas for specialization, including securing networks and allied infrastructure, securing applications and databases, security testing, information systems auditing, business continuity planning, electronic record discovery, and digital forensics.[citation needed] Information security professionals are very stable in their employment.[33] As of 2013 more than 80 percent of professionals had no change in employer or employment over a period of a year, and the number of professionals is projected to continuously grow more than 11 percent annually from 2014 to 2019.[34]

Threats

Information security threats come in many different forms.[35][36] Some of the most common threats today are software attacks, theft of intellectual property, theft of identity, theft of equipment or information, sabotage, and information extortion.[37][38] Viruses,[39] worms, phishing attacks, and Trojan horses are a few common examples of software attacks. The theft of intellectual property has also been an extensive issue for many businesses in the information technology (IT) field.[40] Identity theft is the attempt to act as someone else usually to obtain that person's personal information or to take advantage of their access to vital information through social engineering.[41][42] Theft of equipment or information is becoming more prevalent today due to the fact that most devices today are mobile,[43] are prone to theft and have also become far more desirable as the amount of data capacity increases. Sabotage usually consists of the destruction of an organization's website in an attempt to cause loss of confidence on the part of its customers.[44] Information extortion consists of theft of a company's property or information as an attempt to receive a payment in exchange for returning the information or property back to its owner, as with ransomware.[45] There are many ways to help protect yourself from some of these attacks but one of the most functional precautions is conduct periodical user awareness.[46] The number one threat to any organisation are users or internal employees, they are also called insider threats.[47]

Governments, military, corporations, financial institutions, hospitals, non-profit organisations, and private businesses amass a great deal of confidential information about their employees, customers, products, research, and financial status.[48] Should confidential information about a business's customers or finances or new product line fall into the hands of a competitor or a black hat hacker, a business and its customers could suffer widespread, irreparable financial loss, as well as damage to the company's reputation.[49] From a business perspective, information security must be balanced against cost; the Gordon-Loeb Model provides a mathematical economic approach for addressing this concern.[50]

For the individual, information security has a significant effect on privacy, which is viewed very differently in various cultures.[51]

Responses to threats

Possible responses to a security threat or risk are:[52]

  • reduce/mitigate – implement safeguards and countermeasures to eliminate vulnerabilities or block threats
  • assign/transfer – place the cost of the threat onto another entity or organization such as purchasing insurance or outsourcing
  • accept – evaluate if the cost of the countermeasure outweighs the possible cost of loss due to the threat[53]

History

Since the early days of communication, diplomats and military commanders understood that it was necessary to provide some mechanism to protect the confidentiality of correspondence and to have some means of detecting tampering.[54] Julius Caesar is credited with the invention of the Caesar cipher c. 50 B.C., which was created in order to prevent his secret messages from being read should a message fall into the wrong hands.[55] However, for the most part protection was achieved through the application of procedural handling controls.[56][57] Sensitive information was marked up to indicate that it should be protected and transported by trusted persons, guarded and stored in a secure environment or strong box.[58] As postal services expanded, governments created official organizations to intercept, decipher, read, and reseal letters (e.g., the U.K.'s Secret Office, founded in 1653[59]).

In the mid-nineteenth century more complex classification systems were developed to allow governments to manage their information according to the degree of sensitivity.[60] For example, the British Government codified this, to some extent, with the publication of the Official Secrets Act in 1889.[61] Section 1 of the law concerned espionage and unlawful disclosures of information, while Section 2 dealt with breaches of official trust.[62] A public interest defense was soon added to defend disclosures in the interest of the state.[63] A similar law was passed in India in 1889, The Indian Official Secrets Act, which was associated with the British colonial era and used to crack down on newspapers that opposed the Raj's policies.[64] A newer version was passed in 1923 that extended to all matters of confidential or secret information for governance.[65] By the time of the First World War, multi-tier classification systems were used to communicate information to and from various fronts, which encouraged greater use of code making and breaking sections in diplomatic and military headquarters.[66] Encoding became more sophisticated between the wars as machines were employed to scramble and unscramble information.[67]

The establishment of computer security inaugurated the history of information security. The need for such appeared during World War II.[68] The volume of information shared by the Allied countries during the Second World War necessitated formal alignment of classification systems and procedural controls.[69] An arcane range of markings evolved to indicate who could handle documents (usually officers rather than enlisted troops) and where they should be stored as increasingly complex safes and storage facilities were developed.[70] The Enigma Machine, which was employed by the Germans to encrypt the data of warfare and was successfully decrypted by Alan Turing, can be regarded as a striking example of creating and using secured information.[71] Procedures evolved to ensure documents were destroyed properly, and it was the failure to follow these procedures which led to some of the greatest intelligence coups of the war (e.g., the capture of U-570[71]).

Various Mainframe computers were connected online during the Cold War to complete more sophisticated tasks, in a communication process easier than mailing magnetic tapes back and forth by computer centers. As such, the Advanced Research Projects Agency (ARPA), of the United States Department of Defense, started researching the feasibility of a networked system of communication to trade information within the United States Armed Forces. In 1968, the ARPANET project was formulated by Dr. Larry Roberts, which would later evolve into what is known as the internet.[72]

In 1973, important elements of ARPANET security were found by internet pioneer Robert Metcalfe to have many flaws such as the: "vulnerability of password structure and formats; lack of safety procedures for dial-up connections; and nonexistent user identification and authorizations", aside from the lack of controls and safeguards to keep data safe from unauthorized access. Hackers had effortless access to ARPANET, as phone numbers were known by the public.[73] Due to these problems, coupled with the constant violation of computer security, as well as the exponential increase in the number of hosts and users of the system, "network security" was often alluded to as "network insecurity".[73]

The end of the twentieth century and the early years of the twenty-first century saw rapid advancements in telecommunications, computing hardware and software, and data encryption.[74] The availability of smaller, more powerful, and less expensive computing equipment made electronic data processing within the reach of small business and home users.[75] The establishment of Transfer Control Protocol/Internetwork Protocol (TCP/IP) in the early 1980s enabled different types of computers to communicate.[76] These computers quickly became interconnected through the internet.[77]

The rapid growth and widespread use of electronic data processing and electronic business conducted through the internet, along with numerous occurrences of international terrorism, fueled the need for better methods of protecting the computers and the information they store, process, and transmit.[78] The academic disciplines of computer security and information assurance emerged along with numerous professional organizations, all sharing the common goals of ensuring the security and reliability of information systems.[citation needed]

Basic principles

Key concepts

 
Poster promoting information security by the Russian Ministry of Defence

The CIA triad of confidentiality, integrity, and availability is at the heart of information security.[79] (The members of the classic InfoSec triad—confidentiality, integrity, and availability—are interchangeably referred to in the literature as security attributes, properties, security goals, fundamental aspects, information criteria, critical information characteristics and basic building blocks.)[80] However, debate continues about whether or not this CIA triad is sufficient to address rapidly changing technology and business requirements, with recommendations to consider expanding on the intersections between availability and confidentiality, as well as the relationship between security and privacy.[24] Other principles such as "accountability" have sometimes been proposed; it has been pointed out that issues such as non-repudiation do not fit well within the three core concepts.[81]

The triad seems to have first been mentioned in a NIST publication in 1977.[82]

In 1992 and revised in 2002, the OECD's Guidelines for the Security of Information Systems and Networks[83] proposed the nine generally accepted principles: awareness, responsibility, response, ethics, democracy, risk assessment, security design and implementation, security management, and reassessment.[84] Building upon those, in 2004 the NIST's Engineering Principles for Information Technology Security[81] proposed 33 principles. From each of these derived guidelines and practices.

In 1998, Donn Parker proposed an alternative model for the classic CIA triad that he called the six atomic elements of information. The elements are confidentiality, possession, integrity, authenticity, availability, and utility. The merits of the Parkerian Hexad are a subject of debate amongst security professionals.[85]

In 2011, The Open Group published the information security management standard O-ISM3.[86] This standard proposed an operational definition of the key concepts of security, with elements called "security objectives", related to access control (9), availability (3), data quality (1), compliance, and technical (4). In 2009, DoD Software Protection Initiative 2016-09-25 at the Wayback Machine released the Three Tenets of Cybersecurity 2020-05-10 at the Wayback Machine which are System Susceptibility, Access to the Flaw, and Capability to Exploit the Flaw.[87][88][89] Neither of these models are widely adopted.

Confidentiality

In information security, confidentiality "is the property, that information is not made available or disclosed to unauthorized individuals, entities, or processes."[90] While similar to "privacy," the two words are not interchangeable. Rather, confidentiality is a component of privacy that implements to protect our data from unauthorized viewers.[91] Examples of confidentiality of electronic data being compromised include laptop theft, password theft, or sensitive emails being sent to the incorrect individuals.[92]

Integrity

In IT security, data integrity means maintaining and assuring the accuracy and completeness of data over its entire lifecycle.[93] This means that data cannot be modified in an unauthorized or undetected manner.[94] This is not the same thing as referential integrity in databases, although it can be viewed as a special case of consistency as understood in the classic ACID model of transaction processing.[95] Information security systems typically incorporate controls to ensure their own integrity, in particular protecting the kernel or core functions against both deliberate and accidental threats.[96] Multi-purpose and multi-user computer systems aim to compartmentalize the data and processing such that no user or process can adversely impact another: the controls may not succeed however, as we see in incidents such as malware infections, hacks, data theft, fraud, and privacy breaches.[97]

More broadly, integrity is an information security principle that involves human/social, process, and commercial integrity, as well as data integrity. As such it touches on aspects such as credibility, consistency, truthfulness, completeness, accuracy, timeliness, and assurance.[98]

Availability

For any information system to serve its purpose, the information must be available when it is needed.[99] This means the computing systems used to store and process the information, the security controls used to protect it, and the communication channels used to access it must be functioning correctly.[100] High availability systems aim to remain available at all times, preventing service disruptions due to power outages, hardware failures, and system upgrades.[101] Ensuring availability also involves preventing denial-of-service attacks, such as a flood of incoming messages to the target system, essentially forcing it to shut down.[102]

In the realm of information security, availability can often be viewed as one of the most important parts of a successful information security program.[citation needed] Ultimately end-users need to be able to perform job functions; by ensuring availability an organization is able to perform to the standards that an organization's stakeholders expect.[103] This can involve topics such as proxy configurations, outside web access, the ability to access shared drives and the ability to send emails.[104] Executives oftentimes do not understand the technical side of information security and look at availability as an easy fix, but this often requires collaboration from many different organizational teams, such as network operations, development operations, incident response, and policy/change management.[105] A successful information security team involves many different key roles to mesh and align for the CIA triad to be provided effectively.[106]

Non-repudiation

In law, non-repudiation implies one's intention to fulfill their obligations to a contract. It also implies that one party of a transaction cannot deny having received a transaction, nor can the other party deny having sent a transaction.[107]

It is important to note that while technology such as cryptographic systems can assist in non-repudiation efforts, the concept is at its core a legal concept transcending the realm of technology.[108] It is not, for instance, sufficient to show that the message matches a digital signature signed with the sender's private key, and thus only the sender could have sent the message, and nobody else could have altered it in transit (data integrity).[109] The alleged sender could in return demonstrate that the digital signature algorithm is vulnerable or flawed, or allege or prove that his signing key has been compromised.[110] The fault for these violations may or may not lie with the sender, and such assertions may or may not relieve the sender of liability, but the assertion would invalidate the claim that the signature necessarily proves authenticity and integrity. As such, the sender may repudiate the message (because authenticity and integrity are pre-requisites for non-repudiation).[111]

Risk management

Main article: Risk management

Broadly speaking, risk is the likelihood that something bad will happen that causes harm to an informational asset (or the loss of the asset).[112] A vulnerability is a weakness that could be used to endanger or cause harm to an informational asset. A threat is anything (man-made or act of nature) that has the potential to cause harm.[113] The likelihood that a threat will use a vulnerability to cause harm creates a risk. When a threat does use a vulnerability to inflict harm, it has an impact.[114] In the context of information security, the impact is a loss of availability, integrity, and confidentiality, and possibly other losses (lost income, loss of life, loss of real property).[115]

The Certified Information Systems Auditor (CISA) Review Manual 2006 defines risk management as "the process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives, and deciding what countermeasures,[116] if any, to take in reducing risk to an acceptable level, based on the value of the information resource to the organization."[117]

There are two things in this definition that may need some clarification. First, the process of risk management is an ongoing, iterative process. It must be repeated indefinitely. The business environment is constantly changing and new threats and vulnerabilities emerge every day.[118] Second, the choice of countermeasures (controls) used to manage risks must strike a balance between productivity, cost, effectiveness of the countermeasure, and the value of the informational asset being protected.[119] Furthermore, these processes have limitations as security breaches are generally rare and emerge in a specific context which may not be easily duplicated.[120] Thus, any process and countermeasure should itself be evaluated for vulnerabilities.[121] It is not possible to identify all risks, nor is it possible to eliminate all risk. The remaining risk is called "residual risk.[122]"

A risk assessment is carried out by a team of people who have knowledge of specific areas of the business.[123] Membership of the team may vary over time as different parts of the business are assessed.[124] The assessment may use a subjective qualitative analysis based on informed opinion, or where reliable dollar figures and historical information is available, the analysis may use quantitative analysis.

Research has shown that the most vulnerable point in most information systems is the human user, operator, designer, or other human.[125] The ISO/IEC 27002:2005 Code of practice for information security management recommends the following be examined during a risk assessment:

In broad terms, the risk management process consists of:[126][127]

  1. Identification of assets and estimating their value. Include: people, buildings, hardware, software, data (electronic, print, other), supplies.[128]
  2. Conduct a threat assessment. Include: Acts of nature, acts of war, accidents, malicious acts originating from inside or outside the organization.[129]
  3. Conduct a vulnerability assessment, and for each vulnerability, calculate the probability that it will be exploited. Evaluate policies, procedures, standards, training, physical security, quality control, technical security.[130]
  4. Calculate the impact that each threat would have on each asset. Use qualitative analysis or quantitative analysis.[131]
  5. Identify, select and implement appropriate controls. Provide a proportional response. Consider productivity, cost effectiveness, and value of the asset.[132]
  6. Evaluate the effectiveness of the control measures. Ensure the controls provide the required cost effective protection without discernible loss of productivity.[133]

For any given risk, management can choose to accept the risk based upon the relative low value of the asset, the relative low frequency of occurrence, and the relative low impact on the business.[134] Or, leadership may choose to mitigate the risk by selecting and implementing appropriate control measures to reduce the risk. In some cases, the risk can be transferred to another business by buying insurance or outsourcing to another business.[135] The reality of some risks may be disputed. In such cases leadership may choose to deny the risk.[136]

Security controls

Main article: security controls

Selecting and implementing proper security controls will initially help an organization bring down risk to acceptable levels.[137] Control selection should follow and should be based on the risk assessment.[138] Controls can vary in nature, but fundamentally they are ways of protecting the confidentiality, integrity or availability of information. ISO/IEC 27001 has defined controls in different areas.[139] Organizations can implement additional controls according to requirement of the organization.[140] ISO/IEC 27002 offers a guideline for organizational information security standards.[141]

Administrative

Administrative controls (also called procedural controls) consist of approved written policies, procedures, standards, and guidelines. Administrative controls form the framework for running the business and managing people.[142] They inform people on how the business is to be run and how day-to-day operations are to be conducted. Laws and regulations created by government bodies are also a type of administrative control because they inform the business.[143] Some industry sectors have policies, procedures, standards, and guidelines that must be followed – the Payment Card Industry Data Security Standard[144] (PCI DSS) required by Visa and MasterCard is such an example. Other examples of administrative controls include the corporate security policy, password policy, hiring policies, and disciplinary policies.[145]

Administrative controls form the basis for the selection and implementation of logical and physical controls. Logical and physical controls are manifestations of administrative controls, which are of paramount importance.[142]

Logical

Logical controls (also called technical controls) use software and data to monitor and control access to information and computing systems.[citation needed] Passwords, network and host-based firewalls, network intrusion detection systems, access control lists, and data encryption are examples of logical controls.[146]

An important logical control that is frequently overlooked is the principle of least privilege, which requires that an individual, program or system process not be granted any more access privileges than are necessary to perform the task.[147] A blatant example of the failure to adhere to the principle of least privilege is logging into Windows as user Administrator to read email and surf the web. Violations of this principle can also occur when an individual collects additional access privileges over time.[148] This happens when employees' job duties change, employees are promoted to a new position, or employees are transferred to another department.[149] The access privileges required by their new duties are frequently added onto their already existing access privileges, which may no longer be necessary or appropriate.[150]

Physical

Physical controls monitor and control the environment of the work place and computing facilities.[151] They also monitor and control access to and from such facilities and include doors, locks, heating and air conditioning, smoke and fire alarms, fire suppression systems, cameras, barricades, fencing, security guards, cable locks, etc. Separating the network and workplace into functional areas are also physical controls.[152]

An important physical control that is frequently overlooked is separation of duties, which ensures that an individual can not complete a critical task by himself.[153] For example, an employee who submits a request for reimbursement should not also be able to authorize payment or print the check.[154] An applications programmer should not also be the server administrator or the database administrator; these roles and responsibilities must be separated from one another.[155]

Defense in depth

 
The onion model of defense in depth
Main article: Defense in depth (computing)

Information security must protect information throughout its lifespan, from the initial creation of the information on through to the final disposal of the information.[156] The information must be protected while in motion and while at rest. During its lifetime, information may pass through many different information processing systems and through many different parts of information processing systems.[157] There are many different ways the information and information systems can be threatened. To fully protect the information during its lifetime, each component of the information processing system must have its own protection mechanisms.[158] The building up, layering on, and overlapping of security measures is called "defense in depth."[159] In contrast to a metal chain, which is famously only as strong as its weakest link, the defense in depth strategy aims at a structure where, should one defensive measure fail, other measures will continue to provide protection.[160]

Recall the earlier discussion about administrative controls, logical controls, and physical controls. The three types of controls can be used to form the basis upon which to build a defense in depth strategy.[142] With this approach, defense in depth can be conceptualized as three distinct layers or planes laid one on top of the other.[161] Additional insight into defense in depth can be gained by thinking of it as forming the layers of an onion, with data at the core of the onion, people the next outer layer of the onion, and network security, host-based security, and application security forming the outermost layers of the onion.[162] Both perspectives are equally valid, and each provides valuable insight into the implementation of a good defense in depth strategy.[163]

Classification

An important aspect of information security and risk management is recognizing the value of information and defining appropriate procedures and protection requirements for the information.[164] Not all information is equal and so not all information requires the same degree of protection.[165] This requires information to be assigned a security classification.[166] The first step in information classification is to identify a member of senior management as the owner of the particular information to be classified. Next, develop a classification policy.[167] The policy should describe the different classification labels, define the criteria for information to be assigned a particular label, and list the required security controls for each classification.[168]

Some factors that influence which classification information should be assigned include how much value that information has to the organization, how old the information is and whether or not the information has become obsolete.[169] Laws and other regulatory requirements are also important considerations when classifying information.[170] The Information Systems Audit and Control Association (ISACA) and its Business Model for Information Security also serves as a tool for security professionals to examine security from a systems perspective, creating an environment where security can be managed holistically, allowing actual risks to be addressed.[171]

The type of information security classification labels selected and used will depend on the nature of the organization, with examples being:[168]

  • In the business sector, labels such as: Public, Sensitive, Private, Confidential.
  • In the government sector, labels such as: Unclassified, Unofficial, Protected, Confidential, Secret, Top Secret, and their non-English equivalents.[172]
  • In cross-sectoral formations, the Traffic Light Protocol, which consists of: White, Green, Amber, and Red.

All employees in the organization, as well as business partners, must be trained on the classification schema and understand the required security controls and handling procedures for each classification.[173] The classification of a particular information asset that has been assigned should be reviewed periodically to ensure the classification is still appropriate for the information and to ensure the security controls required by the classification are in place and are followed in their right procedures.[174]

Access control

Access to protected information must be restricted to people who are authorized to access the information.[175] The computer programs, and in many cases the computers that process the information, must also be authorized.[176] This requires that mechanisms be in place to control the access to protected information.[176] The sophistication of the access control mechanisms should be in parity with the value of the information being protected; the more sensitive or valuable the information the stronger the control mechanisms need to be.[177] The foundation on which access control mechanisms are built start with identification and authentication.[178]

Access control is generally considered in three steps: identification, authentication, and authorization.[179][92]

Identification

Identification is an assertion of who someone is or what something is. If a person makes the statement "Hello, my name is John Doe" they are making a claim of who they are.[180] However, their claim may or may not be true. Before John Doe can be granted access to protected information it will be necessary to verify that the person claiming to be John Doe really is John Doe.[181] Typically the claim is in the form of a username. By entering that username you are claiming "I am the person the username belongs to".[182]

Authentication

Authentication is the act of verifying a claim of identity. When John Doe goes into a bank to make a withdrawal, he tells the bank teller he is John Doe, a claim of identity.[183] The bank teller asks to see a photo ID, so he hands the teller his driver's license.[184] The bank teller checks the license to make sure it has John Doe printed on it and compares the photograph on the license against the person claiming to be John Doe.[185] If the photo and name match the person, then the teller has authenticated that John Doe is who he claimed to be. Similarly, by entering the correct password, the user is providing evidence that he/she is the person the username belongs to.[186]

There are three different types of information that can be used for authentication:[187][188]

Strong authentication requires providing more than one type of authentication information (two-factor authentication).[194] The username is the most common form of identification on computer systems today and the password is the most common form of authentication.[195] Usernames and passwords have served their purpose, but they are increasingly inadequate.[196] Usernames and passwords are slowly being replaced or supplemented with more sophisticated authentication mechanisms such as Time-based One-time Password algorithms.[197]

Authorization

After a person, program or computer has successfully been identified and authenticated then it must be determined what informational resources they are permitted to access and what actions they will be allowed to perform (run, view, create, delete, or change).[198] This is called authorization. Authorization to access information and other computing services begins with administrative policies and procedures.[199] The policies prescribe what information and computing services can be accessed, by whom, and under what conditions. The access control mechanisms are then configured to enforce these policies.[200] Different computing systems are equipped with different kinds of access control mechanisms. Some may even offer a choice of different access control mechanisms.[201] The access control mechanism a system offers will be based upon one of three approaches to access control, or it may be derived from a combination of the three approaches.[92]

The non-discretionary approach consolidates all access control under a centralized administration.[202] The access to information and other resources is usually based on the individuals function (role) in the organization or the tasks the individual must perform.[203][204] The discretionary approach gives the creator or owner of the information resource the ability to control access to those resources.[202] In the mandatory access control approach, access is granted or denied basing upon the security classification assigned to the information resource.[175]

Examples of common access control mechanisms in use today include role-based access control, available in many advanced database management systems; simple file permissions provided in the UNIX and Windows operating systems;[205] Group Policy Objects provided in Windows network systems; and Kerberos, RADIUS, TACACS, and the simple access lists used in many firewalls and routers.[206]

To be effective, policies and other security controls must be enforceable and upheld. Effective policies ensure that people are held accountable for their actions.[207] The U.S. Treasury's guidelines for systems processing sensitive or proprietary information, for example, states that all failed and successful authentication and access attempts must be logged, and all access to information must leave some type of audit trail.[208]

Also, the need-to-know principle needs to be in effect when talking about access control. This principle gives access rights to a person to perform their job functions.[209] This principle is used in the government when dealing with difference clearances.[210] Even though two employees in different departments have a top-secret clearance, they must have a need-to-know in order for information to be exchanged. Within the need-to-know principle, network administrators grant the employee the least amount of privilege to prevent employees from accessing more than what they are supposed to.[211] Need-to-know helps to enforce the confidentiality-integrity-availability triad. Need-to-know directly impacts the confidential area of the triad.[212]

Cryptography

Main article: Cryptography

Information security uses cryptography to transform usable information into a form that renders it unusable by anyone other than an authorized user; this process is called encryption.[213] Information that has been encrypted (rendered unusable) can be transformed back into its original usable form by an authorized user who possesses the cryptographic key, through the process of decryption.[214] Cryptography is used in information security to protect information from unauthorized or accidental disclosure while the information is in transit (either electronically or physically) and while information is in storage.[92]

Cryptography provides information security with other useful applications as well, including improved authentication methods, message digests, digital signatures, non-repudiation, and encrypted network communications.[215] Older, less secure applications such as Telnet and File Transfer Protocol (FTP) are slowly being replaced with more secure applications such as Secure Shell (SSH) that use encrypted network communications.[216] Wireless communications can be encrypted using protocols such as WPA/WPA2 or the older (and less secure) WEP. Wired communications (such as ITU‑T G.hn) are secured using AES for encryption and X.1035 for authentication and key exchange.[217] Software applications such as GnuPG or PGP can be used to encrypt data files and email.[218]

Cryptography can introduce security problems when it is not implemented correctly.[219] Cryptographic solutions need to be implemented using industry-accepted solutions that have undergone rigorous peer review by independent experts in cryptography.[220] The length and strength of the encryption key is also an important consideration.[221] A key that is weak or too short will produce weak encryption.[221] The keys used for encryption and decryption must be protected with the same degree of rigor as any other confidential information.[222] They must be protected from unauthorized disclosure and destruction, and they must be available when needed.[223] Public key infrastructure (PKI) solutions address many of the problems that surround key management.[92]

Process

The terms "reasonable and prudent person", "due care", and "due diligence" have been used in the fields of finance, securities, and law for many years. In recent years these terms have found their way into the fields of computing and information security.[127] U.S. Federal Sentencing Guidelines now make it possible to hold corporate officers liable for failing to exercise due care and due diligence in the management of their information systems.[224]

In the business world, stockholders, customers, business partners, and governments have the expectation that corporate officers will run the business in accordance with accepted business practices and in compliance with laws and other regulatory requirements. This is often described as the "reasonable and prudent person" rule. A prudent person takes due care to ensure that everything necessary is done to operate the business by sound business principles and in a legal, ethical manner. A prudent person is also diligent (mindful, attentive, ongoing) in their due care of the business.

In the field of information security, Harris[225] offers the following definitions of due care and due diligence:

"Due care are steps that are taken to show that a company has taken responsibility for the activities that take place within the corporation and has taken the necessary steps to help protect the company, its resources, and employees[226]." And, [Due diligence are the] "continual activities that make sure the protection mechanisms are continually maintained and operational."[227]

Attention should be made to two important points in these definitions.[228][229] First, in due care, steps are taken to show; this means that the steps can be verified, measured, or even produce tangible artifacts.[230][231] Second, in due diligence, there are continual activities; this means that people are actually doing things to monitor and maintain the protection mechanisms, and these activities are ongoing.[232]

Organizations have a responsibility with practicing duty of care when applying information security. The Duty of Care Risk Analysis Standard (DoCRA)[233] provides principles and practices for evaluating risk.[234] It considers all parties that could be affected by those risks.[235] DoCRA helps evaluate safeguards if they are appropriate in protecting others from harm while presenting a reasonable burden.[236] With increased data breach litigation, companies must balance security controls, compliance, and its mission.[237]

Security governance

See also: Information Security Governance

The Software Engineering Institute at Carnegie Mellon University, in a publication titled Governing for Enterprise Security (GES) Implementation Guide, defines characteristics of effective security governance. These include:[238]

  • An enterprise-wide issue
  • Leaders are accountable
  • Viewed as a business requirement
  • Risk-based
  • Roles, responsibilities, and segregation of duties defined
  • Addressed and enforced in policy
  • Adequate resources committed
  • Staff aware and trained
  • A development life cycle requirement
  • Planned, managed, measurable, and measured
  • Reviewed and audited

Incident response plans

An incident response plan (IRP) is a group of policies that dictate an organizations reaction to a cyber attack. Once an security breach has been identified, for example by Network Intrusion Dection System (NIDS) or Host-Based Intrusion Detection System (HIDS) (if configured to do so), the plan is initiated.[239] It is important to note that there can be legal implications to a data breach. Knowing local and federal laws is critical.[240] Every plan is unique to the needs of the organization, and it can involve skill sets that are not part of an IT team.[241] For example, a lawyer may be included in the response plan to help navigate legal implications to a data breach.[citation needed]

As mentioned above every plan is unique but most plans will include the following:[242]

Preparation

Good preparation includes the development of an Incident Response Team (IRT).[243] Skills need to be used by this team would be, penetration testing, computer forensics, network security, etc.[244] This team should also keep track of trends in cybersecurity and modern attack strategies.[245] A training program for end users is important as well as most modern attack strategies target users on the network.[242]

Identification

This part of the incident response plan identifies if there was a security event.[246] When an end user reports information or an admin notices irregularities, an investigation is launched. An incident log is a crucial part of this step.[247] All of the members of the team should be updating this log to ensure that information flows as fast as possible.[248] If it has been identified that a security breach has occurred the next step should be activated.[249]

Containment

In this phase, the IRT works to isolate the areas that the breach took place to limit the scope of the security event.[250] During this phase it is important to preserve information forensically so it can be analyzed later in the process.[251] Containment could be as simple as physically containing a server room or as complex as segmenting a network to not allow the spread of a virus.[252]

Eradication

This is where the threat that was identified is removed from the affected systems.[253] This could include deleting malicious files, terminating compromised accounts, or deleting other components.[254][255] Some events do not require this step, however it is important to fully understand the event before moving to this step.[256] This will help to ensure that the threat is completely removed.[252]

Recovery

This stage is where the systems are restored back to original operation.[257] This stage could include the recovery of data, changing user access information, or updating firewall rules or policies to prevent a breach in the future.[258][259] Without executing this step, the system could still be vulnerable to future security threats.[252]

Lessons Learned

In this step information that has been gathered during this process is used to make future decisions on security.[260] This step is crucial to the ensure that future events are prevented. Using this information to further train admins is critical to the process.[261] This step can also be used to process information that is distributed from other entities who have experienced a security event.[262]

Change management

Main article: Change Management (ITSM)

Change management is a formal process for directing and controlling alterations to the information processing environment.[263][264] This includes alterations to desktop computers, the network, servers, and software.[265] The objectives of change management are to reduce the risks posed by changes to the information processing environment and improve the stability and reliability of the processing environment as changes are made.[266] It is not the objective of change management to prevent or hinder necessary changes from being implemented.[267][268]

Any change to the information processing environment introduces an element of risk.[269] Even apparently simple changes can have unexpected effects.[270] One of management's many responsibilities is the management of risk.[271][272] Change management is a tool for managing the risks introduced by changes to the information processing environment.[273] Part of the change management process ensures that changes are not implemented at inopportune times when they may disrupt critical business processes or interfere with other changes being implemented.[274]

Not every change needs to be managed.[275][276] Some kinds of changes are a part of the everyday routine of information processing and adhere to a predefined procedure, which reduces the overall level of risk to the processing environment.[277] Creating a new user account or deploying a new desktop computer are examples of changes that do not generally require change management.[278] However, relocating user file shares, or upgrading the Email server pose a much higher level of risk to the processing environment and are not a normal everyday activity.[279] The critical first steps in change management are (a) defining change (and communicating that definition) and (b) defining the scope of the change system.[280]

Change management is usually overseen by a change review board composed of representatives from key business areas,[281] security, networking, systems administrators, database administration, application developers, desktop support, and the help desk.[282] The tasks of the change review board can be facilitated with the use of automated work flow application.[283] The responsibility of the change review board is to ensure the organization's documented change management procedures are followed.[284] The change management process is as follows[285]

  • Request: Anyone can request a change.[286][287] The person making the change request may or may not be the same person that performs the analysis or implements the change.[288][289] When a request for change is received, it may undergo a preliminary review to determine if the requested change is compatible with the organizations business model and practices, and to determine the amount of resources needed to implement the change.[290]
  • Approve: Management runs the business and controls the allocation of resources therefore, management must approve requests for changes and assign a priority for every change.[291] Management might choose to reject a change request if the change is not compatible with the business model, industry standards or best practices.[292][293] Management might also choose to reject a change request if the change requires more resources than can be allocated for the change.[294]
  • Plan: Planning a change involves discovering the scope and impact of the proposed change; analyzing the complexity of the change; allocation of resources and, developing, testing, and documenting both implementation and back-out plans.[295] Need to define the criteria on which a decision to back out will be made.[296]
  • Test: Every change must be tested in a safe test environment, which closely reflects the actual production environment, before the change is applied to the production environment.[297] The backout plan must also be tested.[298]
  • Schedule: Part of the change review board's responsibility is to assist in the scheduling of changes by reviewing the proposed implementation date for potential conflicts with other scheduled changes or critical business activities.[299]
  • Communicate: Once a change has been scheduled it must be communicated.[300] The communication is to give others the opportunity to remind the change review board about other changes or critical business activities that might have been overlooked when scheduling the change.[301] The communication also serves to make the help desk and users aware that a change is about to occur.[302] Another responsibility of the change review board is to ensure that scheduled changes have been properly communicated to those who will be affected by the change or otherwise have an interest in the change.[303][304]
  • Implement: At the appointed date and time, the changes must be implemented.[305][306] Part of the planning process was to develop an implementation plan, testing plan and, a back out plan.[307][308] If the implementation of the change should fail or, the post implementation testing fails or, other "drop dead" criteria have been met, the back out plan should be implemented.[309]
  • Document: All changes must be documented.[310][311] The documentation includes the initial request for change, its approval, the priority assigned to it, the implementation,[312] testing and back out plans, the results of the change review board critique, the date/time the change was implemented,[313] who implemented it, and whether the change was implemented successfully, failed or postponed.[314][315]
  • Post-change review: The change review board should hold a post-implementation review of changes.[316] It is particularly important to review failed and backed out changes. The review board should try to understand the problems that were encountered, and look for areas for improvement.[316]

Change management procedures that are simple to follow and easy to use can greatly reduce the overall risks created when changes are made to the information processing environment.[317] Good change management procedures improve the overall quality and success of changes as they are implemented.[318] This is accomplished through planning, peer review, documentation, and communication.[319]

ISO/IEC 20000, The Visible OPS Handbook: Implementing ITIL in 4 Practical and Auditable Steps[320] (Full book summary),[321] and ITIL all provide valuable guidance on implementing an efficient and effective change management program information security.[322]

Business continuity

Business continuity management (BCM) concerns arrangements aiming to protect an organization's critical business functions from interruption due to incidents, or at least minimize the effects.[323][324] BCM is essential to any organization to keep technology and business in line with current threats to the continuation of business as usual.[325] The BCM should be included in an organizations risk analysis plan to ensure that all of the necessary business functions have what they need to keep going in the event of any type of threat to any business function.[326]

It encompasses:

  • Analysis of requirements, e.g., identifying critical business functions, dependencies and potential failure points, potential threats and hence incidents or risks of concern to the organization;[327][328]
  • Specification, e.g., maximum tolerable outage periods; recovery point objectives (maximum acceptable periods of data loss);[329]
  • Architecture and design, e.g., an appropriate combination of approaches including resilience (e.g. engineering IT systems and processes for high availability,[330] avoiding or preventing situations that might interrupt the business), incident and emergency management (e.g., evacuating premises, calling the emergency services, triage/situation[331] assessment and invoking recovery plans), recovery (e.g., rebuilding) and contingency management (generic capabilities to deal positively with whatever occurs using whatever resources are available);[332]
  • Implementation, e.g., configuring and scheduling backups, data transfers, etc., duplicating and strengthening critical elements; contracting with service and equipment suppliers;
  • Testing, e.g., business continuity exercises of various types, costs and assurance levels;[333]
  • Management, e.g., defining strategies, setting objectives and goals; planning and directing the work; allocating funds, people and other resources; prioritization relative to other activities; team building, leadership, control, motivation and coordination with other business functions and activities[334] (e.g., IT, facilities, human resources, risk management, information risk and security, operations); monitoring the situation, checking and updating the arrangements when things change; maturing the approach through continuous improvement, learning and appropriate investment;[citation needed]
  • Assurance, e.g., testing against specified requirements; measuring, analyzing, and reporting key parameters; conducting additional tests, reviews and audits for greater confidence that the arrangements will go to plan if invoked.[335]

Whereas BCM takes a broad approach to minimizing disaster-related risks by reducing both the probability and the severity of incidents, a disaster recovery plan (DRP) focuses specifically on resuming business operations as quickly as possible after a disaster.[336] A disaster recovery plan, invoked soon after a disaster occurs, lays out the steps necessary to recover critical information and communications technology (ICT) infrastructure.[337] Disaster recovery planning includes establishing a planning group, performing risk assessment, establishing priorities, developing recovery strategies, preparing inventories and documentation of the plan, developing verification criteria and procedure, and lastly implementing the plan.[338]

Laws and regulations

 
Privacy International 2007 privacy ranking
green: Protections and safeguards
red: Endemic surveillance societies

Below is a partial listing of governmental laws and regulations in various parts of the world that have, had, or will have, a significant effect on data processing and information security.[339][340] Important industry sector regulations have also been included when they have a significant impact on information security.[339]

  • The UK Data Protection Act 1998 makes new provisions for the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information.[341][342] The European Union Data Protection Directive (EUDPD) requires that all E.U. members adopt national regulations to standardize the protection of data privacy for citizens throughout the E.U.[343][344]
  • The Computer Misuse Act 1990 is an Act of the U.K. Parliament making computer crime (e.g., hacking) a criminal offense.[345] The act has become a model upon which several other countries,[346] including Canada and the Republic of Ireland, have drawn inspiration from when subsequently drafting their own information security laws.[347][348]
  • The E.U.'s Data Retention Directive (annulled) required internet service providers and phone companies to keep data on every electronic message sent and phone call made for between six months and two years.[349]
  • The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232 g; 34 CFR Part 99) is a U.S. Federal law that protects the privacy of student education records.[350] The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.[351] Generally, schools must have written permission from the parent or eligible student[351][352] in order to release any information from a student's education record.[353]
  • The Federal Financial Institutions Examination Council's (FFIEC) security guidelines for auditors specifies requirements for online banking security.[354]
  • The Health Insurance Portability and Accountability Act (HIPAA) of 1996 requires the adoption of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers.[355] Additionally, it requires health care providers, insurance providers and employers to safeguard the security and privacy of health data.[356]
  • The Gramm–Leach–Bliley Act of 1999 (GLBA), also known as the Financial Services Modernization Act of 1999, protects the privacy and security of private financial information that financial institutions collect, hold, and process.[357]
  • Section 404 of the Sarbanes–Oxley Act of 2002 (SOX) requires publicly traded companies to assess the effectiveness of their internal controls for financial reporting in annual reports they submit at the end of each fiscal year.[358] Chief information officers are responsible for the security, accuracy, and the reliability of the systems that manage and report the financial data.[359] The act also requires publicly traded companies to engage with independent auditors who must attest to, and report on, the validity of their assessments.[360]
  • The Payment Card Industry Data Security Standard (PCI DSS) establishes comprehensive requirements for enhancing payment account data security.[361] It was developed by the founding payment brands of the PCI Security Standards Council — including American Express, Discover Financial Services, JCB, MasterCard Worldwide,[362] and Visa International — to help facilitate the broad adoption of consistent data security measures on a global basis.[363] The PCI DSS is a multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures.[364]
  • State security breach notification laws (California and many others) require businesses, nonprofits, and state institutions to notify consumers when unencrypted "personal information" may have been compromised, lost, or stolen.[365]
  • The Personal Information Protection and Electronics Document Act (PIPEDA) of Canada supports and promotes electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances,[366][367] by providing for the use of electronic means to communicate or record information or transactions and by amending the Canada Evidence Act, the Statutory Instruments Act and the Statute Revision Act.[368][369][370]
  • Greece's Hellenic Authority for Communication Security and Privacy (ADAE) (Law 165/2011) establishes and describes the minimum information security controls that should be deployed by every company which provides electronic communication networks and/or services in Greece in order to protect customers' confidentiality.[371] These include both managerial and technical controls (e.g., log records should be stored for two years).[372]
  • Greece's Hellenic Authority for Communication Security and Privacy (ADAE) (Law 205/2013) concentrates around the protection of the integrity and availability of the services and data offered by Greek telecommunication companies.[373] The law forces these and other related companies to build, deploy, and test appropriate business continuity plans and redundant infrastructures.[374]

The US Department of Defense (DoD) issued DoD Directive 8570 in 2004, supplemented by DoD Directive 8140, requiring all DoD employees and all DoD contract personnel involved in information assurance roles and activities to earn and maintain various industry Information Technology (IT) certifications in an effort to ensure that all DoD personnel involved in network infrastructure defense have minimum levels of IT industry recognized knowledge, skills and abilities (KSA). Andersson and Reimers (2019) report these certifications range from CompTIA's A+ and Security+ through the ICS2.org's CISSP, etc.. [375]

Culture

Describing more than simply how security aware employees are, information security culture is the ideas, customs, and social behaviors of an organization that impact information security in both positive and negative ways.[376] Cultural concepts can help different segments of the organization work effectively or work against effectiveness towards information security within an organization. The way employees think and feel about security and the actions they take can have a big impact on information security in organizations. Roer & Petric (2017) identify seven core dimensions of information security culture in organizations:[377]

  • Attitudes: Employees’ feelings and emotions about the various activities that pertain to the organizational security of information.[378]
  • Behaviors: Actual or intended activities and risk-taking actions of employees that have direct or indirect impact on information security.
  • Cognition: Employees' awareness, verifiable knowledge, and beliefs regarding practices, activities, and self-efficacy relation that are related to information security.
  • Communication: Ways employees communicate with each other, sense of belonging, support for security issues, and incident reporting.
  • Compliance: Adherence to organizational security policies, awareness of the existence of such policies and the ability to recall the substance of such policies.
  • Norms: Perceptions of security-related organizational conduct and practices that are informally deemed either normal or deviant by employees and their peers, e.g. hidden expectations regarding security behaviors and unwritten rules regarding uses of information-communication technologies.
  • Responsibilities: Employees' understanding of the roles and responsibilities they have as a critical factor in sustaining or endangering the security of information, and thereby the organization.

Andersson and Reimers (2014) found that employees often do not see themselves as part of the organization Information Security "effort" and often take actions that ignore organizational information security best interests.[379] Research shows information security culture needs to be improved continuously. In Information Security Culture from Analysis to Change, authors commented, "It's a never ending process, a cycle of evaluation and change or maintenance." To manage the information security culture, five steps should be taken: pre-evaluation, strategic planning, operative planning, implementation, and post-evaluation.[380]

  • Pre-Evaluation: to identify the awareness of information security within employees and to analyze current security policy
  • Strategic Planning: to come up a better awareness-program, we need to set clear targets. Clustering people is helpful to achieve it
  • Operative Planning: create a good security culture based on internal communication, management buy-in, security awareness, and training programs
  • Implementation: should feature commitment of management, communication with organizational members, courses for all organizational members, and commitment of the employees[380]
  • Post-evaluation: to better gauge the effectiveness of the prior steps and build on continuous improvement

Sources of standards

Main article: Cyber Security Standards

The International Organization for Standardization (ISO) is an international standards organization organized as a consortium of national standards institutions from 167 countries, coordinated through a secretariat in Geneva, Switzerland. ISO is the world's largest developer of international standards. The International Electrotechnical Commission (IEC) is an international standards organization that deals with electrotechnology and cooperates closely with ISO. ISO/IEC 15443: "Information technology – Security techniques – A framework for IT security assurance", ISO/IEC 27002: "Information technology – Security techniques – Code of practice for information security management", ISO/IEC 20000: "Information technology – Service management", and ISO/IEC 27001: "Information technology – Security techniques – Information security management systems – Requirements" are of particular interest to information security professionals.

The US National Institute of Standards and Technology (NIST) is a non-regulatory federal agency within the U.S. Department of Commerce. The NIST Computer Security Division develops standards, metrics, tests, and validation programs as well as publishes standards and guidelines to increase secure IT planning, implementation, management, and operation. NIST is also the custodian of the U.S. Federal Information Processing Standard publications (FIPS).

The Internet Society is a professional membership society with more than 100 organizations and over 20,000 individual members in over 180 countries. It provides leadership in addressing issues that confront the future of the internet, and it is the organizational home for the groups responsible for internet infrastructure standards, including the Internet Engineering Task Force (IETF) and the Internet Architecture Board (IAB). The ISOC hosts the Requests for Comments (RFCs) which includes the Official Internet Protocol Standards and the RFC-2196 Site Security Handbook.

The Information Security Forum (ISF) is a global nonprofit organization of several hundred leading organizations in financial services, manufacturing, telecommunications, consumer goods, government, and other areas. It undertakes research into information security practices and offers advice in its biannual Standard of Good Practice and more detailed advisories for members.

The Institute of Information Security Professionals (IISP) is an independent, non-profit body governed by its members, with the principal objective of advancing the professionalism of information security practitioners and thereby the professionalism of the industry as a whole. The institute developed the IISP Skills Framework. This framework describes the range of competencies expected of information security and information assurance professionals in the effective performance of their roles. It was developed through collaboration between both private and public sector organizations, world-renowned academics, and security leaders.[381]

The German Federal Office for Information Security (in German Bundesamt für Sicherheit in der Informationstechnik (BSI)) BSI-Standards 100–1 to 100-4 are a set of recommendations including "methods, processes, procedures, approaches and measures relating to information security".[382] The BSI-Standard 100-2 IT-Grundschutz Methodology describes how information security management can be implemented and operated. The standard includes a very specific guide, the IT Baseline Protection Catalogs (also known as IT-Grundschutz Catalogs). Before 2005, the catalogs were formerly known as "IT Baseline Protection Manual". The Catalogs are a collection of documents useful for detecting and combating security-relevant weak points in the IT environment (IT cluster). The collection encompasses as of September 2013 over 4,400 pages with the introduction and catalogs. The IT-Grundschutz approach is aligned with to the ISO/IEC 2700x family.

The European Telecommunications Standards Institute standardized a catalog of information security indicators, headed by the Industrial Specification Group (ISG) ISI.

See also

References

  1. ^ Curry, Michael; Marshall, Byron; Crossler, Robert E.; Correia, John (2018-04-25). "InfoSec Process Action Model (IPAM): Systematically Addressing Individual Security Behavior". ACM SIGMIS Database: The DATABASE for Advances in Information Systems. 49 (SI): 49–66. doi:10.1145/3210530.3210535. ISSN 0095-0033. S2CID 14003960.
  2. ^ Joshi, Chanchala; Singh, Umesh Kumar (August 2017). "Information security risks management framework – A step towards mitigating security risks in university network". Journal of Information Security and Applications. 35: 128–137. doi:10.1016/j.jisa.2017.06.006. ISSN 2214-2126.
  3. ^ Fletcher, Martin (14 December 2016). "An introduction to information risk". The National Archives. Retrieved 23 February 2022.
  4. ^ "SANS Institute: Information Security Resources". www.sans.org. Retrieved 2020-10-31.
  5. ^ Daniel, Kent; Titman, Sheridan (August 2006). "Market Reactions to Tangible and Intangible Information". The Journal of Finance. 61 (4): 1605–1643. doi:10.1111/j.1540-6261.2006.00884.x. SSRN 414701.
  6. ^ Fink, Kerstin (2004). Knowledge Potential Measurement and Uncertainty. Deutscher Universitätsverlag. ISBN 978-3-322-81240-7. OCLC 851734708.
  7. ^ Keyser, Tobias (2018-04-19), "Security policy", The Information Governance Toolkit, CRC Press, pp. 57–62, doi:10.1201/9781315385488-13, ISBN 978-1-315-38548-8, retrieved 2021-05-28
  8. ^ Danzig, Richard (1995). "The big three: Our greatest security risks and how to address them". DTIC ADA421883. {{cite journal}}: Cite journal requires |journal= (help)
  9. ^ Lyu, M.R.; Lau, L.K.Y. (2000). "Firewall security: policies, testing and performance evaluation". Proceedings 24th Annual International Computer Software and Applications Conference. COMPSAC2000. IEEE Comput. Soc: 116–121. doi:10.1109/cmpsac.2000.884700. ISBN 0-7695-0792-1. S2CID 11202223.
  10. ^ "How the Lack of Data Standardization Impedes Data-Driven Healthcare", Data-Driven Healthcare, Hoboken, NJ, USA: John Wiley & Sons, Inc., p. 29, 2015-10-17, doi:10.1002/9781119205012.ch3, ISBN 978-1-119-20501-2, retrieved 2021-05-28
  11. ^ Lent, Tom; Walsh, Bill (2009), "Rethinking Green Building Standards for Comprehensive Continuous Improvement", Common Ground, Consensus Building and Continual Improvement: International Standards and Sustainable Building, West Conshohocken, PA: ASTM International, pp. 1–1–10, doi:10.1520/stp47516s, ISBN 978-0-8031-4507-8, retrieved 2021-05-28
  12. ^ a b Cherdantseva Y. and Hilton J.: "Information Security and Information Assurance. The Discussion about the Meaning, Scope and Goals". In: Organizational, Legal, and Technological Dimensions of Information System Administrator. Almeida F., Portela, I. (eds.). IGI Global Publishing. (2013)
  13. ^ ISO/IEC 27000:2009 (E). (2009). Information technology – Security techniques – Information security management systems – Overview and vocabulary. ISO/IEC.
  14. ^ Committee on National Security Systems: National Information Assurance (IA) Glossary, CNSS Instruction No. 4009, 26 April 2010.
  15. ^ ISACA. (2008). Glossary of terms, 2008. Retrieved from http://www.isaca.org/Knowledge-Center/Documents/Glossary/glossary.pdf
  16. ^ Pipkin, D. (2000). Information security: Protecting the global enterprise. New York: Hewlett-Packard Company.
  17. ^ B., McDermott, E., & Geer, D. (2001). Information security is information risk management. In Proceedings of the 2001 Workshop on New Security Paradigms NSPW ‘01, (pp. 97 – 104). ACM. doi:10.1145/508171.508187
  18. ^ Anderson, J. M. (2003). "Why we need a new definition of information security". Computers & Security. 22 (4): 308–313. doi:10.1016/S0167-4048(03)00407-3.
  19. ^ Venter, H. S.; Eloff, J. H. P. (2003). "A taxonomy for information security technologies". Computers & Security. 22 (4): 299–307. doi:10.1016/S0167-4048(03)00406-1.
  20. ^ Gold, S (December 2004). "Threats looming beyond the perimeter". Information Security Technical Report. 9 (4): 12–14. doi:10.1016/s1363-4127(04)00047-0. ISSN 1363-4127.
  21. ^ Parker, Donn B. (January 1993). "A Comprehensive List of Threats To Information". Information Systems Security. 2 (2): 10–14. doi:10.1080/19393559308551348. ISSN 1065-898X.
  22. ^ Sullivant, John (2016), "The Evolving Threat Environment", Building a Corporate Culture of Security, Elsevier, pp. 33–50, doi:10.1016/b978-0-12-802019-7.00004-3, ISBN 978-0-12-802019-7, retrieved 2021-05-28
  23. ^ Бучик, С. С.; Юдін, О. К.; Нетребко, Р. В. (2016-12-21). "The analysis of methods of determination of functional types of security of the information-telecommunication system from an unauthorized access". Problems of Informatization and Management. 4 (56). doi:10.18372/2073-4751.4.13135. ISSN 2073-4751.
  24. ^ a b Samonas, S.; Coss, D. (2014). . Journal of Information System Security. 10 (3): 21–45. Archived from the original on 2018-09-22. Retrieved 2018-01-25.
  25. ^ "Gartner Says Digital Disruptors Are Impacting All Industries; Digital KPIs Are Crucial to Measuring Success". Gartner. 2 October 2017. Retrieved 25 January 2018.
  26. ^ "Gartner Survey Shows 42 Percent of CEOs Have Begun Digital Business Transformation". Gartner. 24 April 2017. Retrieved 25 January 2018.
  27. ^ Forte, Dario; Power, Richard (December 2007). "Baseline controls in some vital but often-overlooked areas of your information protection programme". Computer Fraud & Security. 2007 (12): 17–20. doi:10.1016/s1361-3723(07)70170-7. ISSN 1361-3723.
  28. ^ Low-voltage switchgear and controlgear. Device profiles for networked industrial devices, BSI British Standards, doi:10.3403/bsen61915, retrieved 2021-05-28
  29. ^ Fetzer, James; Highfill, Tina; Hossiso, Kassu; Howells, Thomas; Strassner, Erich; Young, Jeffrey (November 2018). "Accounting for Firm Heterogeneity within U.S. Industries: Extended Supply-Use Tables and Trade in Value Added using Enterprise and Establishment Level Data". Cambridge, MA. doi:10.3386/w25249. S2CID 169324096. {{cite journal}}: Cite journal requires |journal= (help)
  30. ^ "Secure estimation subject to cyber stochastic attacks", Cloud Control Systems, Emerging Methodologies and Applications in Modelling, Elsevier: 373–404, 2020, doi:10.1016/b978-0-12-818701-2.00021-4, ISBN 978-0-12-818701-2, S2CID 240746156, retrieved 2021-05-28
  31. ^ Nijmeijer, H. (2003). Synchronization of mechanical systems. World Scientific. ISBN 978-981-279-497-0. OCLC 262846185.
  32. ^ "Chapter 1. How students' use of computers has evolved in recent years". dx.doi.org. doi:10.1787/888933277851. Retrieved 2021-05-28.
  33. ^ Information technology. Security techniques. Competence requirements for information security management systems professionals, BSI British Standards, doi:10.3403/30342674, retrieved 2021-05-29
  34. ^ "Information Security Qualifications Fact Sheet" (PDF). IT Governance. Retrieved 16 March 2018.
  35. ^ Ma, Ruiqing Ray (March 2016). "Flexible Displays Come in Many Forms". Information Display. 32 (2): 4–49. doi:10.1002/j.2637-496x.2016.tb00883.x. ISSN 0362-0972.
  36. ^ Rahim, Noor H. (March 2006). Human Rights and Internal Security in Malaysia: Rhetoric and Reality. Defense Technical Information Center. OCLC 74288358.
  37. ^ Kramer, David (2018-09-14). "Nuclear theft and sabotage threats remain high, report warns". Physics Today. doi:10.1063/pt.6.2.20180914a. ISSN 1945-0699. S2CID 240223415.
  38. ^ Wilding, Edward (2 March 2017). Information risk and security : preventing and investigating workplace computer crime. ISBN 978-1-351-92755-0. OCLC 1052118207.
  39. ^ Stewart, James (2012). CISSP Study Guide. Canada: John Wiley & Sons. pp. 255–257. ISBN 978-1-118-31417-3.
  40. ^ "2.2. Productivity growth has been trending down in many sectors". dx.doi.org. doi:10.1787/734700048756. Retrieved 2021-05-28.
  41. ^ "Identity Theft: The Newest Digital Attackking Industry Must Take Seriously". Issues in Information Systems. 2007. doi:10.48009/2_iis_2007_297-302. ISSN 1529-7314.
  42. ^ Wendel-Persson, Anna; Ronnhed, Fredrik (2017). IT-säkerhet och människan : De har världens starkaste mur men porten står alltid på glänt. Umeå universitet, Institutionen för informatik. OCLC 1233659973.
  43. ^ Enge, Eric (5 April 2017). . Archived from the original on 27 April 2018. Retrieved 17 November 2017. Cell phones
  44. ^ Shao, Ruodan; Skarlicki, Daniel P. (2014). "Sabotage toward the Customers who Mistreated Employees Scale". PsycTESTS Dataset. doi:10.1037/t31653-000. Retrieved 2021-05-28.
  45. ^ Kitchen, Julie (June 2008). "7side – Company Information, Company Formations and Property Searches". Legal Information Management. 8 (2): 146. doi:10.1017/s1472669608000364. ISSN 1472-6696. S2CID 144325193.
  46. ^ Young, Courtenay (2018-05-08), "Working with panic attacks", Help Yourself Towards Mental Health, Routledge, pp. 209–214, doi:10.4324/9780429475474-32, ISBN 978-0-429-47547-4, retrieved 2021-05-28
  47. ^ "Introduction: Inside the Insider Threat", Insider Threats, Cornell University Press, pp. 1–9, 2017-12-31, doi:10.7591/9781501705946-003, ISBN 978-1-5017-0594-6, retrieved 2021-05-28
  48. ^ "Table 7.7 France: Comparison of the profit shares of non-financial corporations and non-financial corporations plus unincorporated enterprises". dx.doi.org. doi:10.1787/888933144055. Retrieved 2021-05-28.
  49. ^ "How Did it All Come About?", The Compliance Business and Its Customers, Basingstoke: Palgrave Macmillan, 2012, doi:10.1057/9781137271150.0007, ISBN 978-1-137-27115-0, retrieved 2021-05-28
  50. ^ Gordon, Lawrence; Loeb, Martin (November 2002). "The Economics of Information Security Investment". ACM Transactions on Information and System Security. 5 (4): 438–457. doi:10.1145/581271.581274. S2CID 1500788.
  51. ^ Cho Kim, Byung; Khansa, Lara; James, Tabitha (July 2011). "Individual Trust and Consumer Risk Perception". Journal of Information Privacy and Security. 7 (3): 3–22. doi:10.1080/15536548.2011.10855915. ISSN 1553-6548. S2CID 144643691.
  52. ^ Stewart, James (2012). CISSP Certified Information Systems Security Professional Study Guide Sixth Edition. Canada: John Wiley & Sons, Inc. pp. 255–257. ISBN 978-1-118-31417-3.
  53. ^ Gillett, John (March 1994). "The cost-benefit of outsourcing: assessing the true cost of your outsourcing strategy". European Journal of Purchasing & Supply Management. 1 (1): 45–47. doi:10.1016/0969-7012(94)90042-6. ISSN 0969-7012.
  54. ^ "2.1. Despite strong growth, Austria has lost some ground since the early 1990s". dx.doi.org. doi:10.1787/645173688502. Retrieved 2021-05-29.
  55. ^ "Introduction : Caesar Is Dead. Long Live Caesar!", Julius Caesar’s Self-Created Image and Its Dramatic Afterlife, Bloomsbury Academic, 2018, doi:10.5040/9781474245784.0005, ISBN 978-1-4742-4578-4, retrieved 2021-05-29
  56. ^ Suetonius Tranquillus, Gaius (2008). Lives of the Caesars (Oxford World's Classics). New York: Oxford University Press. p. 28. ISBN 978-0-19-953756-3.
  57. ^ Singh, Simon (2000). The Code Book. Anchor. pp. 289–290. ISBN 978-0-385-49532-5.
  58. ^ Tan, Heng Chuan (2017). Towards trusted and secure communications in a vehicular environment (Thesis). Nanyang Technological University. doi:10.32657/10356/72758.
  59. ^ Johnson, John (1997). The Evolution of British Sigint: 1653–1939. Her Majesty's Stationery Office. ASIN B00GYX1GX2.
  60. ^ Willison, Matthew (14 September 2018). "Were Banks Special? Contrasting Viewpoints in Mid-Nineteenth Century Britain". doi:10.2139/ssrn.3249510. S2CID 169606130. {{cite journal}}: Cite journal requires |journal= (help)
  61. ^ Ruppert, K. (2011). "Official Secrets Act (1889; New 1911; Amended 1920, 1939, 1989)". In Hastedt, G.P. (ed.). Spies, Wiretaps, and Secret Operations: An Encyclopedia of American Espionage. Vol. 2. ABC-CLIO. pp. 589–590. ISBN 9781851098088.
  62. ^ "2. The Clayton Act: A consideration of section 2, defining unlawful price discrimination.", The Federal Anti-Trust Law, Columbia University Press, pp. 18–28, 1930-12-31, doi:10.7312/dunn93452-003, ISBN 978-0-231-89377-0, retrieved 2021-05-29
  63. ^ Maer, Lucinda; Gay (30 December 2008). "Official Secrecy" (PDF). Federation of American Scientists.
  64. ^ "The Official Secrets Act 1989 which replaced section 2 of the 1911 Act", Espionage and Secrecy (Routledge Revivals), Routledge, pp. 267–282, 2016-06-10, doi:10.4324/9781315542515-21, ISBN 978-1-315-54251-5, retrieved 2021-05-29
  65. ^ "Official Secrets Act: what it covers; when it has been used, questioned". The Indian Express. 2019-03-08. Retrieved 2020-08-07.
  66. ^ Singh, Gajendra (November 2015). ""Breaking the Chains with Which We were Bound": The Interrogation Chamber, the Indian National Army and the Negation of Military Identities, 1941–1947". Brill's Digital Library of World War I. doi:10.1163/2352-3786_dlws1_b9789004211452_019. Retrieved 2021-05-28.
  67. ^ Duncanson, Dennis (June 1982). "The scramble to unscramble French Indochina". Asian Affairs. 13 (2): 161–170. doi:10.1080/03068378208730070. ISSN 0306-8374.
  68. ^ Whitman et al. 2017, pp. 3.
  69. ^ "Allied Power. Mobilizing Hydro-Electricity During Canada'S Second World War", Allied Power, University of Toronto Press, pp. 1–2, 2015-12-31, doi:10.3138/9781442617117-003, ISBN 978-1-4426-1711-7, retrieved 2021-05-29
  70. ^ Glatthaar, Joseph T. (2011-06-15), "Officers and Enlisted Men", Soldiering in the Army of Northern Virginia, University of North Carolina Press, pp. 83–96, doi:10.5149/9780807877869_glatthaar.11, ISBN 978-0-8078-3492-3, retrieved 2021-05-28
  71. ^ a b Sebag–Montefiore, H. (2011). Enigma: The Battle for the Code. Orion. p. 576. ISBN 9781780221236.
  72. ^ Whitman et al. 2017, pp. 4–5.
  73. ^ a b Whitman et al. 2017, p. 5.
  74. ^ "Twentieth-Century Wisdom for Twenty-First-Century Communities", Thomas Merton, The Lutterworth Press, pp. 160–184, 2012-04-26, doi:10.2307/j.ctt1cg4k28.13, ISBN 978-0-7188-4069-3, retrieved 2021-05-29
  75. ^ Murphy, Richard C. (2009-09-01). "Building more powerful less expensive supercomputers using Processing-In-Memory (PIM) LDRD final report". doi:10.2172/993898. {{cite journal}}: Cite journal requires |journal= (help)
  76. ^ "A Brief History of the Internet". www.usg.edu. Retrieved 2020-08-07.
  77. ^ "Walking through the view of Delft - on Internet". Computers & Graphics. 25 (5): 927. October 2001. doi:10.1016/s0097-8493(01)00149-2. ISSN 0097-8493.
  78. ^ DeNardis, L. (2007). "Chapter 24: A History of Internet Security". In de Leeuw, K.M.M.; Bergstra, J. (eds.). The History of Information Security: A Comprehensive Handbook. Elsevier. pp. 681–704. ISBN 9780080550589.
  79. ^ Perrin, Chad (30 June 2008). "The CIA Triad". Retrieved 31 May 2012.
  80. ^ Sandhu, Ravi; Jajodia, Sushil (2000-10-20), "Relational Database Security", Information Security Management Handbook, Four Volume Set, Auerbach Publications, doi:10.1201/9780203325438.ch120, ISBN 978-0-8493-1068-3, retrieved 2021-05-29
  81. ^ a b Stoneburner, G.; Hayden, C.; Feringa, A. (2004). "Engineering Principles for Information Technology Security" (PDF). csrc.nist.gov. doi:10.6028/NIST.SP.800-27rA. {{cite journal}}: Cite journal requires |journal= (help)
  82. ^ A. J. Neumann, N. Statland and R. D. Webb (1977). "Post-processing audit tools and techniques" (PDF). US Department of Commerce, National Bureau of Standards. pp. 11-3--11-4.
  83. ^ (PDF). Archived from the original (PDF) on May 16, 2011. Retrieved 2014-01-17.
  84. ^ "GSSP (Generally-Accepted system Security Principles): A trip to abilene". Computers & Security. 15 (5): 417. January 1996. doi:10.1016/0167-4048(96)82630-7. ISSN 0167-4048.
  85. ^ Slade, Rob. "(ICS)2 Blog".
  86. ^ Aceituno, Vicente. "Open Information Security Maturity Model". Retrieved 12 February 2017.
  87. ^ "George Cybenko – George Cybenko's Personal Home Page" (PDF).
  88. ^ Hughes, Jeff; Cybenko, George (21 June 2018). "Quantitative Metrics and Risk Assessment: The Three Tenets Model of Cybersecurity". Technology Innovation Management Review. 3 (8).
  89. ^ Teplow, Lily. "Are Your Clients Falling for These IT Security Myths? [CHART]". continuum.net.
  90. ^ Beckers, K. (2015). Pattern and Security Requirements: Engineering-Based Establishment of Security Standards. Springer. p. 100. ISBN 9783319166643.
  91. ^ "Data Privacy and Confidentiality", SpringerReference, Berlin/Heidelberg: Springer-Verlag, 2011, doi:10.1007/springerreference_205286, retrieved 2021-05-29
  92. ^ a b c d e Andress, J. (2014). The Basics of Information Security: Understanding the Fundamentals of InfoSec in Theory and Practice. Syngress. p. 240. ISBN 9780128008126.
  93. ^ Boritz, J. Efrim (2005). "IS Practitioners' Views on Core Concepts of Information Integrity". International Journal of Accounting Information Systems. Elsevier. 6 (4): 260–279. doi:10.1016/j.accinf.2005.07.001.
  94. ^ Hryshko, I. (2020). "Unauthorized Occupation of Land and Unauthorized Construction: Concepts and Types of Tactical Means of Investigation". International Humanitarian University Herald. Jurisprudence (43): 180–184. doi:10.32841/2307-1745.2020.43.40. ISSN 2307-1745.
  95. ^ Kim, Bonn-Oh (2000-09-21), "Referential Integrity for Database Design", High-Performance Web Databases, Auerbach Publications, pp. 427–434, doi:10.1201/9781420031560-34, ISBN 978-0-429-11600-1, retrieved 2021-05-29
  96. ^ Pevnev, V. (2018). "Model Threats and Ensure the Integrity of Information". Systems and Technologies. 2 (56): 80–95. doi:10.32836/2521-6643-2018.2-56.6. ISSN 2521-6643.
  97. ^ Fan, Lejun; Wang, Yuanzhuo; Cheng, Xueqi; Li, Jinming; Jin, Shuyuan (2013-02-26). "Privacy theft malware multi-process collaboration analysis". Security and Communication Networks. 8 (1): 51–67. doi:10.1002/sec.705. ISSN 1939-0114.
  98. ^ "Completeness, Consistency, and Integrity of the Data Model". Measuring Data Quality for Ongoing Improvement. MK Series on Business Intelligence. Elsevier. 2013. pp. e11–e19. doi:10.1016/b978-0-12-397033-6.00030-4. ISBN 978-0-12-397033-6. Retrieved 2021-05-29.
  99. ^ "Video from SPIE - the International Society for Optics and Photonics". dx.doi.org. doi:10.1117/12.2266326.5459349132001. Retrieved 2021-05-29.
  100. ^ "Communication Skills Used by Information Systems Graduates". Issues in Information Systems. 2005. doi:10.48009/1_iis_2005_311-317. ISSN 1529-7314.
  101. ^ "Outages of electric power supply resulting from cable failures Boston Edison Company system". 1980-07-01. doi:10.2172/5083196. OSTI 5083196. Retrieved 18 January 2022. {{cite journal}}: Cite journal requires |journal= (help)
  102. ^ Loukas, G.; Oke, G. (September 2010) [August 2009]. (PDF). Comput. J. 53 (7): 1020–1037. doi:10.1093/comjnl/bxp078. Archived from the original (PDF) on 2012-03-24. Retrieved 2015-08-28.
  103. ^ "Be Able To Perform a Clinical Activity", Definitions, Qeios, 2020-02-02, doi:10.32388/dine5x, S2CID 241238722, retrieved 2021-05-29
  104. ^ Ohta, Mai; Fujii, Takeo (May 2011). "Iterative cooperative sensing on shared primary spectrum for improving sensing ability". 2011 IEEE International Symposium on Dynamic Spectrum Access Networks (DySPAN). IEEE: 623–627. doi:10.1109/dyspan.2011.5936257. ISBN 978-1-4577-0177-1. S2CID 15119653.
  105. ^ Information technology. Information security incident management, BSI British Standards, doi:10.3403/30387743, retrieved 2021-05-29
  106. ^ Blum, Dan (2020), "Identify and Align Security-Related Roles", Rational Cybersecurity for Business, Berkeley, CA: Apress, pp. 31–60, doi:10.1007/978-1-4842-5952-8_2, ISBN 978-1-4842-5951-1, S2CID 226626983, retrieved 2021-05-29
  107. ^ McCarthy, C. (2006). "Digital Libraries: Security and Preservation Considerations". In Bidgoli, H. (ed.). Handbook of Information Security, Threats, Vulnerabilities, Prevention, Detection, and Management. Vol. 3. John Wiley & Sons. pp. 49–76. ISBN 9780470051214.
  108. ^ Information technology. Open systems interconnection. Security frameworks for open systems, BSI British Standards, doi:10.3403/01110206u, retrieved 2021-05-29
  109. ^ Christofori, Ralf (2014-01-01), "Thus could it have been", Julio Rondo - O.k., Meta Memory, Wilhelm Fink Verlag, doi:10.30965/9783846757673_003, ISBN 978-3-7705-5767-7, retrieved 2021-05-29
  110. ^ Atkins, D. (May 2021). "Use of the Walnut Digital Signature Algorithm with CBOR Object Signing and Encryption (COSE)". doi:10.17487/rfc9021. S2CID 182252627. Retrieved 18 January 2022. {{cite journal}}: Cite journal requires |journal= (help)
  111. ^ Le May, I. (2003), "Structural Integrity in the Petrochemical Industry", Comprehensive Structural Integrity, Elsevier, pp. 125–149, doi:10.1016/b0-08-043749-4/01001-6, ISBN 978-0-08-043749-1, retrieved 2021-05-29
  112. ^ Sodjahin, Amos; Champagne, Claudia; Coggins, Frank; Gillet, Roland (2017-01-11). "Leading or lagging indicators of risk? The informational content of extra-financial performance scores". Journal of Asset Management. 18 (5): 347–370. doi:10.1057/s41260-016-0039-y. ISSN 1470-8272. S2CID 157485290.
  113. ^ Reynolds, E H (1995-07-22). "Folate has potential to cause harm". BMJ. 311 (6999): 257. doi:10.1136/bmj.311.6999.257. ISSN 0959-8138. PMC 2550299. PMID 7503870.
  114. ^ Randall, Alan (2011), "Harm, risk, and threat", Risk and Precaution, Cambridge: Cambridge University Press, pp. 31–42, doi:10.1017/cbo9780511974557.003, ISBN 978-0-511-97455-7, retrieved 2021-05-29
  115. ^ Grama, J.L. (2014). Legal Issues in Information Security. Jones & Bartlett Learning. p. 550. ISBN 9781284151046.
  116. ^ Cannon, David L. (2016-03-04). "Audit Process". CISA: Certified Information Systems Auditor Study Guide (Fourth ed.). pp. 139–214. doi:10.1002/9781119419211.ch3. ISBN 9781119056249.
  117. ^ CISA Review Manual 2006. Information Systems Audit and Control Association. 2006. p. 85. ISBN 978-1-933284-15-6.
  118. ^ Kadlec, Jaroslav (2012-11-02). "Two‐dimensional process modeling (2DPM)". Business Process Management Journal. 18 (6): 849–875. doi:10.1108/14637151211283320. ISSN 1463-7154.
  119. ^ "All Countermeasures Have Some Value, But No Countermeasure Is Perfect", Beyond Fear, New York: Springer-Verlag, pp. 207–232, 2003, doi:10.1007/0-387-21712-6_14, ISBN 0-387-02620-7, retrieved 2021-05-29
  120. ^ "Data breaches: Deloitte suffers serious hit while more details emerge about Equifax and Yahoo". Computer Fraud & Security. 2017 (10): 1–3. October 2017. doi:10.1016/s1361-3723(17)30086-6. ISSN 1361-3723.
  121. ^ Spagnoletti, Paolo; Resca A. (2008). "The duality of Information Security Management: fighting against predictable and unpredictable threats". Journal of Information System Security. 4 (3): 46–62.
  122. ^ Yusoff, Nor Hashim; Yusof, Mohd Radzuan (2009-08-04). "Managing HSE Risk in Harsh Environment". All Days. SPE. doi:10.2118/122545-ms.
  123. ^ Baxter, Wesley (2010). Sold out: how Ottawa's downtown business improvement areas have secured and valorized urban space (Thesis). Carleton University. doi:10.22215/etd/2010-09016.
  124. ^ de Souza, André; Lynch, Anthony (June 2012). "Does Mutual Fund Performance Vary over the Business Cycle?". Cambridge, MA. doi:10.3386/w18137. {{cite journal}}: Cite journal requires |journal= (help)
  125. ^ Kiountouzis, E.A.; Kokolakis, S.A. (1996-05-31). Information systems security: facing the information society of the 21st century. London: Chapman & Hall, Ltd. ISBN 978-0-412-78120-9.
  126. ^ Newsome, B. (2013). A Practical Introduction to Security and Risk Management. SAGE Publications. p. 208. ISBN 9781483324852.
  127. ^ a b Whitman, M.E.; Mattord, H.J. (2016). Management of Information Security (5th ed.). Cengage Learning. p. 592. ISBN 9781305501256.
  128. ^ "Hardware, Fabrics, Adhesives, and Other Theatrical Supplies", Illustrated Theatre Production Guide, Routledge, pp. 203–232, 2013-03-20, doi:10.4324/9780080958392-20, ISBN 978-0-08-095839-2, retrieved 2021-05-29
  129. ^ Reason, James (2017-03-02), "Perceptions of Unsafe Acts", The Human Contribution, CRC Press, pp. 69–103, doi:10.1201/9781315239125-7, ISBN 978-1-315-23912-5, retrieved 2021-05-29
  130. ^ "Information Security Procedures and Standards", Information Security Policies, Procedures, and Standards, Boca Raton, FL: Auerbach Publications, pp. 81–92, 2017-03-27, doi:10.1201/9781315372785-5, ISBN 978-1-315-37278-5, retrieved 2021-05-29
  131. ^ Zhuang, Haifeng; Chen, Yu; Sheng, Xianfu; Hong, Lili; Gao, Ruilan; Zhuang, Xiaofen (25 June 2020). "Figure S1: Analysis of the prognostic impact of each single signature gene". PeerJ. 8: e9437. doi:10.7717/peerj.9437/supp-1. Retrieved 2021-05-29.
  132. ^ Standaert, B.; Ethgen, O.; Emerson, R.A. (June 2012). "CO4 Cost-Effectiveness Analysis - Appropriate for All Situations?". Value in Health. 15 (4): A2. doi:10.1016/j.jval.2012.03.015. ISSN 1098-3015.
  133. ^ "GRP canopies provide cost-effective over-door protection". Reinforced Plastics. 40 (11): 8. November 1996. doi:10.1016/s0034-3617(96)91328-4. ISSN 0034-3617.
  134. ^ "Figure 2.3. Relative risk of being a low performer depending on personal circumstances (2012)". dx.doi.org. doi:10.1787/888933171410. Retrieved 2021-05-29.
  135. ^ Stoneburner, Gary; Goguen, Alice; Feringa, Alexis (2002). "NIST SP 800-30 Risk Management Guide for Information Technology Systems". doi:10.6028/NIST.SP.800-30. Retrieved 18 January 2022. {{cite journal}}: Cite journal requires |journal= (help)
  136. ^ "May I Choose? Can I Choose? Oppression and Choice", A Theory of Freedom, Palgrave Macmillan, 2012, doi:10.1057/9781137295026.0007, ISBN 978-1-137-29502-6, retrieved 2021-05-29
  137. ^ Parker, Donn B. (January 1994). "A Guide to Selecting and Implementing Security Controls". Information Systems Security. 3 (2): 75–86. doi:10.1080/10658989409342459. ISSN 1065-898X.
  138. ^ Zoccali, Carmine; Mallamaci, Francesca; Tripepi, Giovanni (2007-09-25). "Guest Editor: Rajiv Agarwal: Cardiovascular Risk Profile Assessment and Medication Control Should Come First". Seminars in Dialysis. 20 (5): 405–408. doi:10.1111/j.1525-139x.2007.00317.x. ISSN 0894-0959. PMID 17897245. S2CID 33256127.
  139. ^ Guide to the Implementation and Auditing of ISMS Controls based on ISO/IEC 27001. London: BSI British Standards. 2013-11-01. doi:10.3403/9780580829109. ISBN 978-0-580-82910-9.
  140. ^ Johnson, L. (2015). Security Controls Evaluation, Testing, and Assessment Handbook. Syngress. p. 678. ISBN 9780128025642.
  141. ^ Information technology. Security techniques. Mapping the revised editions of ISO/IEC 27001 and ISO/IEC 27002, BSI British Standards, doi:10.3403/30310928, retrieved 2021-05-29
  142. ^ a b c "Administrative Controls", Occupational Ergonomics, CRC Press, pp. 443–666, 2003-03-26, doi:10.1201/9780203507933-6, ISBN 978-0-429-21155-3, retrieved 2021-05-29
  143. ^ Chen, J.; Demers, E.A.; Lev, B. (June 2013). "How Time of Day Impacts on Business Conversations". doi:10.13007/141. Retrieved 18 January 2022. {{cite journal}}: Cite journal requires |journal= (help)CS1 maint: multiple names: authors list (link)
  144. ^ 44 U.S.C. § 3542(b)(1)
  145. ^ "Appendix D", Information Security Policy Development for Compliance, Auerbach Publications, pp. 117–136, 2013-03-22, doi:10.1201/b13922-12, ISBN 978-1-4665-8058-9, retrieved 2021-05-29
  146. ^ "Firewalls, Intrusion Detection Systems and Vulnerability Assessment: A Superior Conjunction?". Network Security. 2002 (9): 8–11. September 2002. doi:10.1016/s1353-4858(02)09009-8. ISSN 1353-4858.
  147. ^ Ransome, J.; Misra, A. (2013). Core Software Security: Security at the Source. CRC Press. pp. 40–41. ISBN 9781466560956.
  148. ^ "least privilege principle", SpringerReference, Berlin/Heidelberg: Springer-Verlag, 2011, doi:10.1007/springerreference_17456, retrieved 2021-05-29
  149. ^ Emir, Astra (September 2018). "19. Duties of Ex-employees". Law Trove. doi:10.1093/he/9780198814849.003.0019. ISBN 978-0-19-185251-0.
  150. ^ Guide for Information Access Privileges to Health Information, ASTM International, doi:10.1520/e1986-09, retrieved 2021-05-29
  151. ^ Drury, Bill (2009-01-01), "Physical environment", Control Techniques, Drives and Controls Handbook, Institution of Engineering and Technology: 355–381, doi:10.1049/pbpo057e_chb3, ISBN 978-1-84919-013-8, retrieved 2021-05-29
  152. ^ Fire detection and fire alarms systems, BSI British Standards, doi:10.3403/30266863, retrieved 2021-05-29
  153. ^ Silverman, Arnold B. (November 2001). "Employee exit interviews—An important but frequently overlooked procedure". JOM. 53 (11): 48. Bibcode:2001JOM....53k..48S. doi:10.1007/s11837-001-0195-4. ISSN 1047-4838. S2CID 137528079.
  154. ^ "Many employee pharmacists should be able to benefit". The Pharmaceutical Journal. 2013. doi:10.1211/pj.2013.11124182. ISSN 2053-6186.
  155. ^ . ISACA. 2008. Archived from the original on 3 July 2011. Retrieved 2008-09-30.
  156. ^ "Residents Must Protect Their Private Information". JAMA. 279 (17): 1410B. 1998-05-06. doi:10.1001/jama.279.17.1410. ISSN 0098-7484.
  157. ^ "Group Wisdom Support Systems: Aggregating the Insights of Many Through Information Technology". Issues in Information Systems. 2008. doi:10.48009/2_iis_2008_343-350. ISSN 1529-7314.
  158. ^ "INTERDEPENDENCIES OF INFORMATION SYSTEMS", Lessons Learned: Critical Information Infrastructure Protection, IT Governance Publishing, pp. 34–37, 2018, doi:10.2307/j.ctt1xhr7hq.13, ISBN 978-1-84928-958-0, retrieved 2021-05-29
  159. ^ "Managing Network Security", Network Perimeter Security, Auerbach Publications, pp. 17–66, 2003-10-27, doi:10.1201/9780203508046-3, ISBN 978-0-429-21157-7, retrieved 2021-05-29
  160. ^ Kakareka, A. (2013). "Chapter 31: What is Vulnerability Assessment?". In Vacca, J.R. (ed.). Computer and Information Security Handbook (2nd ed.). Elsevier. pp. 541–552. ISBN 9780123946126.
  161. ^ Duke, P. A.; Howard, I. P. (2012-08-17). "Processing vertical size disparities in distinct depth planes". Journal of Vision. 12 (8): 10. doi:10.1167/12.8.10. ISSN 1534-7362. PMID 22904355.
  162. ^ "Security Onion Control Scripts". Applied Network Security Monitoring. Elsevier. 2014. pp. 451–456. doi:10.1016/b978-0-12-417208-1.09986-4. ISBN 978-0-12-417208-1. Retrieved 2021-05-29.
  163. ^ "Metabolomics Provides Valuable Insight for the Study of Durum Wheat: A Review". dx.doi.org. doi:10.1021/acs.jafc.8b07097.s001. Retrieved 2021-05-29.
  164. ^ "Overview", Information Security Policies, Procedures, and Standards, Auerbach Publications, 2001-12-20, doi:10.1201/9780849390326.ch1, ISBN 978-0-8493-1137-6, retrieved 2021-05-29
  165. ^ Electrical protection relays. Information and requirements for all protection relays, BSI British Standards, doi:10.3403/bs142-1, retrieved 2021-05-29
  166. ^ Dibattista, Joseph D.; Reimer, James D.; Stat, Michael; Masucci, Giovanni D.; Biondi, Piera; Brauwer, Maarten De; Bunce, Michael (6 February 2019). "Supplemental Information 4: List of all combined families in alphabetical order assigned in MEGAN vers. 5.11.3". PeerJ. 7: e6379. doi:10.7717/peerj.6379/supp-4. Retrieved 2021-05-29.
  167. ^ Kim, Sung-Won (2006-03-31). "A Quantitative Analysis of Classification Classes and Classified Information Resources of Directory". Journal of Information Management. 37 (1): 83–103. doi:10.1633/jim.2006.37.1.083. ISSN 0254-3621.
  168. ^ a b Bayuk, J. (2009). "Chapter 4: Information Classification". In Axelrod, C.W.; Bayuk, J.L.; Schutzer, D. (eds.). Enterprise Information Security and Privacy. Artech House. pp. 59–70. ISBN 9781596931916.
  169. ^ "Welcome to the Information Age", Overload!, Hoboken, NJ, USA: John Wiley & Sons, Inc., pp. 43–65, 2015-09-11, doi:10.1002/9781119200642.ch5, ISBN 978-1-119-20064-2, retrieved 2021-05-29
  170. ^ Crooks, S. (2006). "102. Case Study: When Exposure Control Efforts Override Other Important Design Considerations". AIHce 2006. AIHA. doi:10.3320/1.2759009.
  171. ^ "Business Model for Information Security (BMIS)". ISACA. Retrieved 25 January 2018.
  172. ^ McAuliffe, Leo (January 1987). "Top secret/trade secret: Accessing and safeguarding restricted information". Government Information Quarterly. 4 (1): 123–124. doi:10.1016/0740-624x(87)90068-2. ISSN 0740-624X.
  173. ^ Khairuddin, Ismail Mohd; Sidek, Shahrul Naim; Abdul Majeed, Anwar P.P.; Razman, Mohd Azraai Mohd; Puzi, Asmarani Ahmad; Yusof, Hazlina Md (25 February 2021). "Figure 7: Classification accuracy for each model for all features". PeerJ Computer Science. 7: e379. doi:10.7717/peerj-cs.379/fig-7. Retrieved 2021-05-29.
  174. ^ "Asset Classification", Information Security Fundamentals, Auerbach Publications, pp. 327–356, 2013-10-16, doi:10.1201/b15573-18, ISBN 978-0-429-13028-1, retrieved 2021-06-01
  175. ^ a b Almehmadi, Abdulaziz; El-Khatib, Khalil (2013). "Authorized! access denied, unauthorized! access granted". Proceedings of the 6th International Conference on Security of Information and Networks - SIN '13. Sin '13. New York, New York, USA: ACM Press: 363–367. doi:10.1145/2523514.2523612. ISBN 978-1-4503-2498-4. S2CID 17260474.
  176. ^ a b Peiss, Kathy (2020), "The Country of the Mind Must Also Attack", Information Hunters, Oxford University Press, pp. 16–39, doi:10.1093/oso/9780190944612.003.0003, ISBN 978-0-19-094461-2, retrieved 2021-06-01
  177. ^ Fugini, M.G.; Martella, G. (January 1988). "A petri-net model of access control mechanisms". Information Systems. 13 (1): 53–63. doi:10.1016/0306-4379(88)90026-9. ISSN 0306-4379.
  178. ^ Information technology. Personal identification. ISO-compliant driving licence, BSI British Standards, doi:10.3403/30170670u, retrieved 2021-06-01
  179. ^ Santos, Omar (2015). Ccna security 210-260 official cert guide. Cisco press. ISBN 978-1-58720-566-8. OCLC 951897116.
  180. ^ "What is Assertion?", ASSERTION TRAINING, Abingdon, UK: Taylor & Francis, pp. 1–7, 1991, doi:10.4324/9780203169186_chapter_one, ISBN 978-0-203-28556-5, retrieved 2021-06-01
  181. ^ Doe, John (1960). "Field Season In Illinois Begins May 2". Soil Horizons. 1 (2): 10. doi:10.2136/sh1960.2.0010. ISSN 2163-2812.
  182. ^ Leech, M. (March 1996). "Username/Password Authentication for SOCKS V5". doi:10.17487/rfc1929. Retrieved 18 January 2022. {{cite journal}}: Cite journal requires |journal= (help)
  183. ^ Kirk, John; Wall, Christine (2011), "Teller, Seller, Union Activist: Class Formation and Changing Bank Worker Identities", Work and Identity, London: Palgrave Macmillan UK, pp. 124–148, doi:10.1057/9780230305625_6, ISBN 978-1-349-36871-6, retrieved 2021-06-01
  184. ^ Dewi, Mila Nurmala (2020-12-23). "Perbandingan Kinerja Teller Kriya Dan Teller Organik Pt. Bank Syariah Mandiri". Nisbah: Jurnal Perbankan Syariah. 6 (2): 75. doi:10.30997/jn.v6i2.1932. ISSN 2528-6633. S2CID 234420571.
  185. ^ Vile, John (2013), "License Checks", Encyclopedia of the Fourth Amendment, Washington DC: CQ Press, doi:10.4135/9781452234243.n462, ISBN 978-1-60426-589-7, retrieved 2021-06-01
  186. ^ "He Said/She Said", My Ghost Has a Name, University of South Carolina Press, pp. 17–32, doi:10.2307/j.ctv6wgjjv.6, ISBN 978-1-61117-827-2, retrieved 2021-05-29
  187. ^ Bacigalupo, Sonny A.; Dixon, Linda K.; Gubbins, Simon; Kucharski, Adam J.; Drewe, Julian A. (26 October 2020). "Supplemental Information 8: Methods used to monitor different types of contact". PeerJ. 8: e10221. doi:10.7717/peerj.10221/supp-8. Retrieved 2021-06-01.
  188. ^ Igelnik, Boris M.; Zurada, Jacek (2013). Efficiency and scalability methods for computational intellect. ISBN 978-1-4666-3942-3. OCLC 833130899.
  189. ^ "The Insurance Superbill Must Have Your Name as the Provider", Before You See Your First Client, Routledge, pp. 37–38, 2005-01-01, doi:10.4324/9780203020289-11, ISBN 978-0-203-02028-9, retrieved 2021-06-01
  190. ^ Kissell, Joe. Take Control of Your Passwords. ISBN 978-1-4920-6638-5. OCLC 1029606129.
  191. ^ "New smart Queensland driver license announced". Card Technology Today. 21 (7): 5. July 2009. doi:10.1016/s0965-2590(09)70126-4. ISSN 0965-2590.
  192. ^ Lawrence Livermore National Laboratory. United States. Department of Energy. Office of Scientific and Technical Information (1995). A human engineering and ergonomic evaluation of the security access panel interface. United States. Dept. of Energy. OCLC 727181384.
  193. ^ Lee, Paul (April 2017). "Prints charming: how fingerprints are trailblazing mainstream biometrics". Biometric Technology Today. 2017 (4): 8–11. doi:10.1016/s0969-4765(17)30074-7. ISSN 0969-4765.
  194. ^ "Two-Factor Authentication", SpringerReference, Berlin/Heidelberg: Springer-Verlag, 2011, doi:10.1007/springerreference_546, retrieved 2021-06-01
  195. ^ "Figure 1.5. Marriage remains the most common form of partnership among couples, 2000-07". dx.doi.org. doi:10.1787/888932392533. Retrieved 2021-06-01.
  196. ^ Akpeninor, James Ohwofasa (2013). Modern Concepts of Security. Bloomington, IN: AuthorHouse. p. 135. ISBN 978-1-4817-8232-6. Retrieved 18 January 2018.
  197. ^ Richards, G. (April 2012). "One-Time Password (OTP) Pre-Authentication". doi:10.17487/rfc6560. {{cite journal}}: Cite journal requires |journal= (help)
  198. ^ Schumacher, Dietmar (2016-04-03). "Surface geochemical exploration after 85 years: What has been accomplished and what more must be done". International Conference and Exhibition, Barcelona, Spain, 3–6 April 2016. SEG Global Meeting Abstracts. Society of Exploration Geophysicists and American Association of Petroleum Geologists: 100. doi:10.1190/ice2016-6522983.1.
  199. ^ "Authorization And Approval Program", Internal Controls Policies and Procedures, Hoboken, NJ, USA: John Wiley & Sons, Inc., pp. 69–72, 2015-10-23, doi:10.1002/9781119203964.ch10, ISBN 978-1-119-20396-4, retrieved 2021-06-01
  200. ^ "What responses under what conditions?", Local Policies and the European Social Fund, Policy Press, pp. 81–102, 2019-10-02, doi:10.2307/j.ctvqc6hn1.12, ISBN 978-1-4473-4652-4, S2CID 241438707, retrieved 2021-06-01
  201. ^ Cheng, Liang; Zhang, Yang; Han, Zhihui (June 2013). "Quantitatively Measure Access Control Mechanisms across Different Operating Systems". 2013 IEEE 7th International Conference on Software Security and Reliability. IEEE: 50–59. doi:10.1109/sere.2013.12. ISBN 978-1-4799-0406-8. S2CID 13261344.
  202. ^ a b "discretionary access control", SpringerReference, Berlin/Heidelberg: Springer-Verlag, 2011, doi:10.1007/springerreference_12629, retrieved 2021-06-01
  203. ^ "Individual Subunits of the Glutamate Transporter EAAC1 Homotrimer Function Independently of Each Other". dx.doi.org. doi:10.1021/bi050987n.s001. Retrieved 2021-06-01.
  204. ^ Ellis Ormrod, Jeanne (2012). Essentials of educational psychology : big ideas to guide effective teaching. Pearson. ISBN 978-0-13-136727-2. OCLC 663953375.
  205. ^ Belim, S. V.; Bogachenko, N. F.; Kabanov, A. N. (November 2018). "Severity Level of Permissions in Role-Based Access Control". 2018 Dynamics of Systems, Mechanisms and Machines (Dynamics). IEEE: 1–5. arXiv:1812.11404. doi:10.1109/dynamics.2018.8601460. ISBN 978-1-5386-5941-0. S2CID 57189531.
  206. ^ "Configuring TACACS and Extended TACACS", Securing and Controlling Cisco Routers, Auerbach Publications, 2002-05-15, doi:10.1201/9781420031454.ch11, ISBN 978-0-8493-1290-8, retrieved 2021-06-01
  207. ^ "Developing Effective Security Policies", Risk Analysis and Security Countermeasure Selection, CRC Press, pp. 261–274, 2009-12-18, doi:10.1201/9781420078718-18, ISBN 978-0-429-24979-2, retrieved 2021-06-01
  208. ^ "The Use of Audit Trails to Monitor Key Networks and Systems Should Remain Part of the Computer Security Material Weakness". www.treasury.gov. Retrieved 2017-10-06.
  209. ^ "fixing-canadas-access-to-medicines-regime-what-you-need-to-know-about-bill-c398". Human Rights Documents online. doi:10.1163/2210-7975_hrd-9902-0152. Retrieved 2021-06-01.
  210. ^ Salazar, Mary K. (January 2006). "Dealing with Uncertain Risks—When to Apply the Precautionary Principle". AAOHN Journal. 54 (1): 11–13. doi:10.1177/216507990605400102. ISSN 0891-0162. S2CID 87769508.
  211. ^ "We Need to Know More About How the Government Censors Its Employees". Human Rights Documents Online. doi:10.1163/2210-7975_hrd-9970-2016117. Retrieved 2021-06-01.
  212. ^ Pournelle, Jerry (2004-04-22), "1001 Computer Words You Need to Know", Oxford University Press, doi:10.1093/oso/9780195167757.003.0007, ISBN 978-0-19-516775-7, retrieved 2021-07-30 {{citation}}: Missing or empty |title= (help)
  213. ^ Easttom, William (2021), "Elliptic Curve Cryptography", Modern Cryptography, Cham: Springer International Publishing, pp. 245–256, doi:10.1007/978-3-030-63115-4_11, ISBN 978-3-030-63114-7, S2CID 234106555, retrieved 2021-06-01
  214. ^ Follman, Rebecca (2014-03-01). From Someone Who Has Been There: Information Seeking in Mentoring. IConference 2014 Proceedings (Thesis). iSchools. doi:10.9776/14322. hdl:1903/14292. ISBN 978-0-9884900-1-7.
  215. ^ Weiss, Jason (2004), "Message Digests, Message Authentication Codes, and Digital Signatures", Java Cryptography Extensions, Elsevier, pp. 101–118, doi:10.1016/b978-012742751-5/50012-8, ISBN 978-0-12-742751-5, retrieved 2021-06-05
  216. ^ Bider, D. (March 2018). "Use of RSA Keys with SHA-256 and SHA-512 in the Secure Shell (SSH) Protocol". doi:10.17487/rfc8332. {{cite journal}}: Cite journal requires |journal= (help)
  217. ^ Noh, Jaewon; Kim, Jeehyeong; Kwon, Giwon; Cho, Sunghyun (October 2016). "Secure key exchange scheme for WPA/WPA2-PSK using public key cryptography". 2016 IEEE International Conference on Consumer Electronics-Asia (ICCE-Asia). IEEE: 1–4. doi:10.1109/icce-asia.2016.7804782. ISBN 978-1-5090-2743-9. S2CID 10595698.
  218. ^ Van Buren, Roy F. (May 1990). "How you can use the data encryption standard to encrypt your files and data bases". ACM SIGSAC Review. 8 (2): 33–39. doi:10.1145/101126.101130. ISSN 0277-920X.
  219. ^ Bonneau, Joseph (2016), "Why Buy When You Can Rent?", Financial Cryptography and Data Security, Lecture Notes in Computer Science, Berlin, Heidelberg: Springer Berlin Heidelberg, vol. 9604, pp. 19–26, doi:10.1007/978-3-662-53357-4_2, ISBN 978-3-662-53356-7, retrieved 2021-06-05
  220. ^ Coleman, Heather; Andron, Jeff (2015-08-01), "What GIS Experts and Policy Professionals Need to Know about Using Marxan in Multiobjective Planning Processes", Ocean Solutions, Earth Solutions, Esri Press, doi:10.17128/9781589483651_2, ISBN 978-1-58948-365-1, retrieved 2021-06-05
  221. ^ a b "Key Encryption Key", SpringerReference, Berlin/Heidelberg: Springer-Verlag, 2011, doi:10.1007/springerreference_323, retrieved 2021-06-05
  222. ^ Giri, Debasis; Barua, Prithayan; Srivastava, P. D.; Jana, Biswapati (2010), "A Cryptosystem for Encryption and Decryption of Long Confidential Messages", Communications in Computer and Information Science, Berlin, Heidelberg: Springer Berlin Heidelberg, vol. 76, pp. 86–96, Bibcode:2010isa..conf...86G, doi:10.1007/978-3-642-13365-7_9, ISBN 978-3-642-13364-0, retrieved 2021-06-05
  223. ^ "Video from SPIE - the International Society for Optics and Photonics". dx.doi.org. doi:10.1117/12.2266326.5459349132001. Retrieved 2021-06-05.
  224. ^ Vallabhaneni, S.R. (2008). Corporate Management, Governance, and Ethics Best Practices. John Wiley & Sons. p. 288. ISBN 9780470255803.
  225. ^ Shon Harris (2003). All-in-one CISSP Certification Exam Guide (2nd ed.). Emeryville, California: McGraw-Hill/Osborne. ISBN 978-0-07-222966-0.
  226. ^ Boncardo, Robert (2018-09-20). "Jean-Claude Milner's Mallarmé: Nothing Has Taken Place". Edinburgh University Press. 1. doi:10.3366/edinburgh/9781474429528.003.0005. S2CID 172045429.
  227. ^ "The Importance of Operational Due Diligence", Hedge Fund Operational Due Diligence, Hoboken, NJ, USA: John Wiley & Sons, Inc., pp. 49–67, 2015-10-16, doi:10.1002/9781119197485.ch2, ISBN 978-1-119-19748-5, retrieved 2021-06-05
  228. ^ Hall, Gaylord C. (March 1917). "Some Important Diagnostic Points the General Practioner [sic] Should Know About the Nose". Southern Medical Journal. 10 (3): 211. doi:10.1097/00007611-191703000-00007. ISSN 0038-4348.
  229. ^ Renes, J. (1999). Landschappen van Maas en Peel: een toegepast historisch-geografisch onderzoek in het streekplangebied Noord- en Midden-Limburg. Eisma. ISBN 90-74252-84-2. OCLC 782897414.
  230. ^ Thomas, Brook (2017-06-22). "Minding Previous Steps Taken". Oxford Scholarship Online. doi:10.1093/acprof:oso/9780190456368.003.0002. ISBN 978-0-19-045639-9.
  231. ^ Lundgren, Regina E. (2018). Risk communication : a handbook for communicating environmental, safety, and health risks. ISBN 978-1-119-45613-1. OCLC 1043389392.
  232. ^ Jensen, Eric Talbot (2020-12-03), "Due Diligence in Cyber Activities", Due Diligence in the International Legal Order, Oxford University Press, pp. 252–270, doi:10.1093/oso/9780198869900.003.0015, ISBN 978-0-19-886990-0, retrieved 2021-06-05
  233. ^ . DoCRA. Archived from the original on 2018-08-14. Retrieved 2018-08-15.
  234. ^ Sutton, Adam; Cherney, Adrian; White, Rob (2008), "Evaluating crime prevention", Crime Prevention, Cambridge: Cambridge University Press, pp. 70–90, doi:10.1017/cbo9780511804601.006, ISBN 978-0-511-80460-1, retrieved 2021-06-05
  235. ^ Check, Erika (2004-09-15). "FDA considers antidepressant risks for kids". Nature. doi:10.1038/news040913-15. ISSN 0028-0836.
  236. ^ Auckland, Cressida (2017-08-16). "Protecting me from my Directive: Ensuring Appropriate Safeguards for Advance Directives in Dementia". Medical Law Review. 26 (1): 73–97. doi:10.1093/medlaw/fwx037. ISSN 0967-0742. PMID 28981694.
  237. ^ Takach, George S. (2016), "Preparing for Breach Litigation", Data Breach Preparation and Response, Elsevier, pp. 217–230, doi:10.1016/b978-0-12-803451-4.00009-5, ISBN 978-0-12-803451-4, retrieved 2021-06-05
  238. ^ Westby, J.R.; Allen, J.H. (August 2007). "Governing for Enterprise Security (GES) Implementation Guide" (PDF). Software Engineering Institute. Retrieved 25 January 2018.
  239. ^ Fowler, Kevvie (2016), "Developing a Computer Security Incident Response Plan", Data Breach Preparation and Response, Elsevier, pp. 49–77, doi:10.1016/b978-0-12-803451-4.00003-4, ISBN 978-0-12-803451-4, retrieved 2021-06-05
  240. ^ Bisogni, Fabio (2016). "Proving Limits of State Data Breach Notification Laws: Is a Federal Law the Most Adequate Solution?". Journal of Information Policy. 6: 154–205. doi:10.5325/jinfopoli.6.2016.0154. JSTOR 10.5325/jinfopoli.6.2016.0154.
  241. ^ "Understanding Plan for Every Part", Turbo Flow, Productivity Press, pp. 21–30, 2017-07-27, doi:10.1201/b10336-5, ISBN 978-0-429-24603-6, retrieved 2021-06-05
  242. ^ a b Wills, Leonard (27 February 2019). "A Brief Guide to Handling a Cyber Incident". American Bar Association.
  243. ^ Johnson, Leighton R. (2014), "Part 1. Incident Response Team", Computer Incident Response and Forensics Team Management, Elsevier, pp. 17–19, doi:10.1016/b978-1-59749-996-5.00038-8, ISBN 978-1-59749-996-5, retrieved 2021-06-05
  244. ^ "Computer Incident Response and Forensics Team Management". Network Security. 2014 (2): 4. February 2014. doi:10.1016/s1353-4858(14)70018-2. ISSN 1353-4858.
  245. ^ "Cybersecurity Threat Landscape and Future Trends", Cybersecurity, Routledge, pp. 304–343, 2015-04-16, doi:10.1201/b18335-12, ISBN 978-0-429-25639-4, retrieved 2021-06-05
  246. ^ Information technology. Security techniques. Information security incident management, BSI British Standards, doi:10.3403/30268878u, retrieved 2021-06-05
  247. ^ "Investigation of a Flow Step Clogging Incident: A Precautionary Note on the Use of THF in Commercial-Scale Continuous Process". dx.doi.org. doi:10.1021/acs.oprd.9b00366.s001. Retrieved 2021-06-05.
  248. ^ Turner, Tim (2011-09-07), "Our Beginning: Team Members Who Began the Success Story", One Team on All Levels, Productivity Press, pp. 9–36, doi:10.4324/9781466500020-2, ISBN 978-0-429-25314-0, retrieved 2021-06-05
  249. ^ Erlanger, Leon (2002). Defensive Strategies. PC Magazine. p. 70.
  250. ^ "of Belgrade's main street. The event took place in absolute", Radical Street Performance, Routledge, pp. 81–83, 2013-11-05, doi:10.4324/9781315005140-28, ISBN 978-1-315-00514-0, retrieved 2021-06-05
  251. ^ "Why Choice Matters So Much and What Can be Done to Preserve It". The Manipulation of Choice. Palgrave Macmillan. 2013. doi:10.1057/9781137313577.0010. ISBN 978-1-137-31357-7. Retrieved 2021-06-05.
  252. ^ a b c "Computer Security Incident Handling Guide" (PDF). Nist.gov. 2012.
  253. ^ Borgström, Pernilla; Strengbom, Joachim; Viketoft, Maria; Bommarco, Riccardo (4 April 2016). "Table S3: Results from linear-mixed models where non-signficant [sic] parameters have not been removed". PeerJ. 4: e1867. doi:10.7717/peerj.1867/supp-3. Retrieved 2021-06-05.
  254. ^ Penfold, David (2000), "Selecting, Copying, Moving and Deleting Files and Directories", ECDL Module 2: Using the Computer and Managing Files, London: Springer London, pp. 86–94, doi:10.1007/978-1-4471-0491-9_6, ISBN 978-1-85233-443-7, retrieved 2021-06-05
  255. ^ Gumus, Onur (2018). ASP. NET Core 2 Fundamentals : Build Cross-Platform Apps and Dynamic Web Services with This Server-side Web Application Framework. Packt Publishing Ltd. ISBN 978-1-78953-355-2. OCLC 1051139482.
  256. ^ "Do the Students Understand What They Are Learning?", Trouble-shooting Your Teaching, Routledge, pp. 36–40, 2005-02-25, doi:10.4324/9780203416907-8, ISBN 978-0-203-41690-7, retrieved 2021-06-05
  257. ^ "Where Are Films Restored, Where Do They Come From and Who Restores Them?", Film Restoration, Palgrave Macmillan, 2013, doi:10.1057/9781137328724.0006, ISBN 978-1-137-32872-4, retrieved 2021-06-05
  258. ^ Liao, Qi; Li, Zhen; Striegel, Aaron (2011-01-24). "Could firewall rules be public - a game theoretical perspective". Security and Communication Networks. 5 (2): 197–210. doi:10.1002/sec.307. ISSN 1939-0114.
  259. ^ Boeckman, Philip; Greenwald, David J.; Von Bismarck, Nilufer (2013). Twelfth annual institute on securities regulation in Europe : overcoming deal-making challenges in the current markets. Practising Law Institute. ISBN 978-1-4024-1932-4. OCLC 825824220.
  260. ^ "Figure 1.8. Spending of social security has been growing, while self-financing has been falling". dx.doi.org. doi:10.1787/888932459242. Retrieved 2021-06-05.
  261. ^ "Information Governance: The Crucial First Step", Safeguarding Critical E-Documents, Hoboken, NJ, USA: John Wiley & Sons, Inc., pp. 13–24, 2015-09-19, doi:10.1002/9781119204909.ch2, ISBN 978-1-119-20490-9, retrieved 2021-06-05
  262. ^ He, Ying (December 1, 2017). "Challenges of Information Security Incident Learning: An Industrial Case Study in a Chinese Healthcare Organization" (PDF). Informatics for Health and Social Care. 42 (4): 394–395. doi:10.1080/17538157.2016.1255629. PMID 28068150. S2CID 20139345.
  263. ^ Kampfner, Roberto R. (1985). "Formal specification of information systems requirements". Information Processing & Management. 21 (5): 401–414. doi:10.1016/0306-4573(85)90086-x. ISSN 0306-4573.
  264. ^ Jenner, H.A. (1995). Assessment of ecotoxicological risks of element leaching from pulverized coal ashes. s.n.] OCLC 905474381.
  265. ^ "Desktop Computers: Software", Practical Pathology Informatics, New York: Springer-Verlag, pp. 51–82, 2006, doi:10.1007/0-387-28058-8_3, ISBN 0-387-28057-X, retrieved 2021-06-05
  266. ^ Wilby, R.L.; Orr, H.G.; Hedger, M.; Forrow, D.; Blackmore, M. (December 2006). "Risks posed by climate change to the delivery of Water Framework Directive objectives in the UK". Environment International. 32 (8): 1043–1055. doi:10.1016/j.envint.2006.06.017. ISSN 0160-4120. PMID 16857260.
  267. ^ Campbell, T. (2016). "Chapter 14: Secure Systems Development". Practical Information Security Management: A Complete Guide to Planning and Implementation. Apress. p. 218. ISBN 9781484216859.
  268. ^ L., Koppelman, Kent (2011). Understanding human differences : multicultural education for a diverse America. Pearson/Allyn & Bacon. OCLC 1245910610.
  269. ^ "POST-PROCESSING", Simple Scene, Sensational Shot, Routledge, pp. 128–147, 2013-04-12, doi:10.4324/9780240821351-9, ISBN 978-0-240-82135-1, retrieved 2021-06-05
  270. ^ Kumar, Binay; Mahto, Tulsi; Kumari, Vinita; Ravi, Binod Kumar; Deepmala (2016). "Quackery: How It Can Prove Fatal Even in Apparently Simple Cases-A Case Report". Medico-Legal Update. 16 (2): 75. doi:10.5958/0974-1283.2016.00063.3. ISSN 0971-720X.
  271. ^ Priest, Sally (2019-02-22). "Shared roles and responsibilities in flood risk management". Journal of Flood Risk Management. 12 (1): e12528. doi:10.1111/jfr3.12528. ISSN 1753-318X. S2CID 133789858.
  272. ^ United States. Department of Energy. Office of Inspector General. Office of Scientific and Technical Information (2009). Audit Report, "Fire Protection Deficiencies at Los Alamos National Laboratory.". United States. Dept. of Energy. OCLC 727225166.
  273. ^ Toms, Elaine G. (January 1992). "Managing change in libraries and information services; A systems approach". Information Processing & Management. 28 (2): 281–282. doi:10.1016/0306-4573(92)90052-2. ISSN 0306-4573.
  274. ^ Abolhassan, Ferri (2003), "The Change Management Process Implemented at IDS Scheer", Business Process Change Management, Berlin, Heidelberg: Springer Berlin Heidelberg, pp. 15–22, doi:10.1007/978-3-540-24703-6_2, ISBN 978-3-642-05532-4, retrieved 2021-06-05
  275. ^ Dawson, Chris (2020-07-01). Leading Culture Change. doi:10.1515/9780804774673. ISBN 9780804774673. S2CID 242348822.
  276. ^ McCormick, Douglas P. (22 March 2016). Family Inc. : using business principles to maximize your family's wealth. ISBN 978-1-119-21976-7. OCLC 945632737.
  277. ^ Schuler, Rainer (August 1995). "Some properties of sets tractable under every polynomial-time computable distribution". Information Processing Letters. 55 (4): 179–184. doi:10.1016/0020-0190(95)00108-o. ISSN 0020-0190.
  278. ^ "Figure 12.2. Share of own-account workers who generally do not have more than one client" (Excel). dx.doi.org. doi:10.1787/888933881610. Retrieved 2021-06-05.
  279. ^ "Multi-user file server for DOS LANs". Computer Communications. 10 (3): 153. June 1987. doi:10.1016/0140-3664(87)90353-7. ISSN 0140-3664.
  280. ^ "Defining Organizational Change", Organizational Change, Oxford, UK: Wiley-Blackwell, pp. 21–51, 2011-04-19, doi:10.1002/9781444340372.ch1, ISBN 978-1-4443-4037-2, retrieved 2021-06-05
  281. ^ Kirchmer, Mathias; Scheer, August-Wilhelm (2003), "Change Management — Key for Business Process Excellence", Business Process Change Management, Berlin, Heidelberg: Springer Berlin Heidelberg, pp. 1–14, doi:10.1007/978-3-540-24703-6_1, ISBN 978-3-642-05532-4, retrieved 2021-06-05
  282. ^ More, Josh; Stieber, Anthony J.; Liu, Chris (2016), "Tier 2—Advanced Help Desk—Help Desk Supervisor", Breaking Into Information Security, Elsevier, pp. 111–113, doi:10.1016/b978-0-12-800783-9.00029-x, ISBN 978-0-12-800783-9, retrieved 2021-06-05
  283. ^ "An Application of Bayesian Networks in Automated Scoring of Computerized Simulation Tasks", Automated Scoring of Complex Tasks in Computer-Based Testing, Routledge, pp. 212–264, 2006-04-04, doi:10.4324/9780415963572-10, ISBN 978-0-415-96357-2,

March 16, 2023
information, security, sometimes, shortened, infosec, practice, protecting, information, mitigating, information, risks, part, information, risk, management, typically, involves, preventing, reducing, probability, unauthorized, inappropriate, access, data, unl. Information security sometimes shortened to InfoSec 1 is the practice of protecting information by mitigating information risks It is part of information risk management 2 3 It typically involves preventing or reducing the probability of unauthorized inappropriate access to data or the unlawful use disclosure disruption deletion corruption modification inspection recording or devaluation of information 4 It also involves actions intended to reduce the adverse impacts of such incidents Protected information may take any form e g electronic or physical tangible e g paperwork or intangible e g knowledge 5 6 Information security s primary focus is the balanced protection of the confidentiality integrity and availability of data also known as the CIA triad while maintaining a focus on efficient policy implementation all without hampering organization productivity 7 This is largely achieved through a structured risk management process that involves identifying information and related assets plus potential threats vulnerabilities and impacts evaluating the risks deciding how to address or treat the risks i e to avoid mitigate share or accept them where risk mitigation is required selecting or designing appropriate security controls and implementing them monitoring the activities making adjustments as necessary to address any issues changes and improvement opportunities 8 To standardize this discipline academics and professionals collaborate to offer guidance policies and industry standards on password antivirus software firewall encryption software legal liability security awareness and training and so forth 9 This standardization may be further driven by a wide variety of laws and regulations that affect how data is accessed processed stored transferred and destroyed 10 However the implementation of any standards and guidance within an entity may have limited effect if a culture of continual improvement isn t adopted 11 Contents 1 Definition 2 Overview 2 1 Threats 2 1 1 Responses to threats 3 History 4 Basic principles 4 1 Key concepts 4 1 1 Confidentiality 4 1 2 Integrity 4 1 3 Availability 4 1 4 Non repudiation 5 Risk management 5 1 Security controls 5 1 1 Administrative 5 1 2 Logical 5 1 3 Physical 5 2 Defense in depth 5 3 Classification 5 4 Access control 5 4 1 Identification 5 4 2 Authentication 5 4 3 Authorization 5 5 Cryptography 6 Process 6 1 Security governance 6 2 Incident response plans 6 2 1 Preparation 6 2 2 Identification 6 2 3 Containment 6 2 4 Eradication 6 2 5 Recovery 6 2 6 Lessons Learned 6 3 Change management 7 Business continuity 8 Laws and regulations 9 Culture 10 Sources of standards 11 See also 12 References 13 Further reading 13 1 Bibliography 14 External linksDefinition Edit Information Security Attributes or qualities i e Confidentiality Integrity and Availability CIA Information Systems are composed in three main portions hardware software and communications with the purpose to help identify and apply information security industry standards as mechanisms of protection and prevention at three levels or layers physical personal and organizational Essentially procedures or policies are implemented to tell administrators users and operators how to use products to ensure information security within the organizations 12 Various definitions of information security are suggested below summarized from different sources Preservation of confidentiality integrity and availability of information Note In addition other properties such as authenticity accountability non repudiation and reliability can also be involved ISO IEC 27000 2009 13 The protection of information and information systems from unauthorized access use disclosure disruption modification or destruction in order to provide confidentiality integrity and availability CNSS 2010 14 Ensures that only authorized users confidentiality have access to accurate and complete information integrity when required availability ISACA 2008 15 Information Security is the process of protecting the intellectual property of an organisation Pipkin 2000 16 information security is a risk management discipline whose job is to manage the cost of information risk to the business McDermott and Geer 2001 17 A well informed sense of assurance that information risks and controls are in balance Anderson J 2003 18 Information security is the protection of information and minimizes the risk of exposing information to unauthorized parties Venter and Eloff 2003 19 Information Security is a multidisciplinary area of study and professional activity which is concerned with the development and implementation of security mechanisms of all available types technical organizational human oriented and legal in order to keep information in all its locations within and outside the organization s perimeter and consequently information systems where information is created processed stored transmitted and destroyed free from threats 20 Threats to information and information systems may be categorized and a corresponding security goal may be defined for each category of threats 21 A set of security goals identified as a result of a threat analysis should be revised periodically to ensure its adequacy and conformance with the evolving environment 22 The currently relevant set of security goals may include confidentiality integrity availability privacy authenticity amp trustworthiness non repudiation accountability and auditability Cherdantseva and Hilton 2013 12 Information and information resource security using telecommunication system or devices means protecting information information systems or books from unauthorized access damage theft or destruction Kurose and Ross 2010 23 Overview EditAt the core of information security is information assurance the act of maintaining the confidentiality integrity and availability CIA of information ensuring that information is not compromised in any way when critical issues arise 24 These issues include but are not limited to natural disasters computer server malfunction and physical theft While paper based business operations are still prevalent requiring their own set of information security practices enterprise digital initiatives are increasingly being emphasized 25 26 with information assurance now typically being dealt with by information technology IT security specialists These specialists apply information security to technology most often some form of computer system It is worthwhile to note that a computer does not necessarily mean a home desktop 27 A computer is any device with a processor and some memory Such devices can range from non networked standalone devices as simple as calculators to networked mobile computing devices such as smartphones and tablet computers 28 IT security specialists are almost always found in any major enterprise establishment due to the nature and value of the data within larger businesses 29 They are responsible for keeping all of the technology within the company secure from malicious cyber attacks that often attempt to acquire critical private information or gain control of the internal systems 30 31 The field of information security has grown and evolved significantly in recent years 32 It offers many areas for specialization including securing networks and allied infrastructure securing applications and databases security testing information systems auditing business continuity planning electronic record discovery and digital forensics citation needed Information security professionals are very stable in their employment 33 As of 2013 update more than 80 percent of professionals had no change in employer or employment over a period of a year and the number of professionals is projected to continuously grow more than 11 percent annually from 2014 to 2019 34 Threats Edit Information security threats come in many different forms 35 36 Some of the most common threats today are software attacks theft of intellectual property theft of identity theft of equipment or information sabotage and information extortion 37 38 Viruses 39 worms phishing attacks and Trojan horses are a few common examples of software attacks The theft of intellectual property has also been an extensive issue for many businesses in the information technology IT field 40 Identity theft is the attempt to act as someone else usually to obtain that person s personal information or to take advantage of their access to vital information through social engineering 41 42 Theft of equipment or information is becoming more prevalent today due to the fact that most devices today are mobile 43 are prone to theft and have also become far more desirable as the amount of data capacity increases Sabotage usually consists of the destruction of an organization s website in an attempt to cause loss of confidence on the part of its customers 44 Information extortion consists of theft of a company s property or information as an attempt to receive a payment in exchange for returning the information or property back to its owner as with ransomware 45 There are many ways to help protect yourself from some of these attacks but one of the most functional precautions is conduct periodical user awareness 46 The number one threat to any organisation are users or internal employees they are also called insider threats 47 Governments military corporations financial institutions hospitals non profit organisations and private businesses amass a great deal of confidential information about their employees customers products research and financial status 48 Should confidential information about a business s customers or finances or new product line fall into the hands of a competitor or a black hat hacker a business and its customers could suffer widespread irreparable financial loss as well as damage to the company s reputation 49 From a business perspective information security must be balanced against cost the Gordon Loeb Model provides a mathematical economic approach for addressing this concern 50 For the individual information security has a significant effect on privacy which is viewed very differently in various cultures 51 Responses to threats Edit Possible responses to a security threat or risk are 52 reduce mitigate implement safeguards and countermeasures to eliminate vulnerabilities or block threats assign transfer place the cost of the threat onto another entity or organization such as purchasing insurance or outsourcing accept evaluate if the cost of the countermeasure outweighs the possible cost of loss due to the threat 53 History EditSince the early days of communication diplomats and military commanders understood that it was necessary to provide some mechanism to protect the confidentiality of correspondence and to have some means of detecting tampering 54 Julius Caesar is credited with the invention of the Caesar cipher c 50 B C which was created in order to prevent his secret messages from being read should a message fall into the wrong hands 55 However for the most part protection was achieved through the application of procedural handling controls 56 57 Sensitive information was marked up to indicate that it should be protected and transported by trusted persons guarded and stored in a secure environment or strong box 58 As postal services expanded governments created official organizations to intercept decipher read and reseal letters e g the U K s Secret Office founded in 1653 59 In the mid nineteenth century more complex classification systems were developed to allow governments to manage their information according to the degree of sensitivity 60 For example the British Government codified this to some extent with the publication of the Official Secrets Act in 1889 61 Section 1 of the law concerned espionage and unlawful disclosures of information while Section 2 dealt with breaches of official trust 62 A public interest defense was soon added to defend disclosures in the interest of the state 63 A similar law was passed in India in 1889 The Indian Official Secrets Act which was associated with the British colonial era and used to crack down on newspapers that opposed the Raj s policies 64 A newer version was passed in 1923 that extended to all matters of confidential or secret information for governance 65 By the time of the First World War multi tier classification systems were used to communicate information to and from various fronts which encouraged greater use of code making and breaking sections in diplomatic and military headquarters 66 Encoding became more sophisticated between the wars as machines were employed to scramble and unscramble information 67 The establishment of computer security inaugurated the history of information security The need for such appeared during World War II 68 The volume of information shared by the Allied countries during the Second World War necessitated formal alignment of classification systems and procedural controls 69 An arcane range of markings evolved to indicate who could handle documents usually officers rather than enlisted troops and where they should be stored as increasingly complex safes and storage facilities were developed 70 The Enigma Machine which was employed by the Germans to encrypt the data of warfare and was successfully decrypted by Alan Turing can be regarded as a striking example of creating and using secured information 71 Procedures evolved to ensure documents were destroyed properly and it was the failure to follow these procedures which led to some of the greatest intelligence coups of the war e g the capture of U 570 71 Various Mainframe computers were connected online during the Cold War to complete more sophisticated tasks in a communication process easier than mailing magnetic tapes back and forth by computer centers As such the Advanced Research Projects Agency ARPA of the United States Department of Defense started researching the feasibility of a networked system of communication to trade information within the United States Armed Forces In 1968 the ARPANET project was formulated by Dr Larry Roberts which would later evolve into what is known as the internet 72 In 1973 important elements of ARPANET security were found by internet pioneer Robert Metcalfe to have many flaws such as the vulnerability of password structure and formats lack of safety procedures for dial up connections and nonexistent user identification and authorizations aside from the lack of controls and safeguards to keep data safe from unauthorized access Hackers had effortless access to ARPANET as phone numbers were known by the public 73 Due to these problems coupled with the constant violation of computer security as well as the exponential increase in the number of hosts and users of the system network security was often alluded to as network insecurity 73 The end of the twentieth century and the early years of the twenty first century saw rapid advancements in telecommunications computing hardware and software and data encryption 74 The availability of smaller more powerful and less expensive computing equipment made electronic data processing within the reach of small business and home users 75 The establishment of Transfer Control Protocol Internetwork Protocol TCP IP in the early 1980s enabled different types of computers to communicate 76 These computers quickly became interconnected through the internet 77 The rapid growth and widespread use of electronic data processing and electronic business conducted through the internet along with numerous occurrences of international terrorism fueled the need for better methods of protecting the computers and the information they store process and transmit 78 The academic disciplines of computer security and information assurance emerged along with numerous professional organizations all sharing the common goals of ensuring the security and reliability of information systems citation needed Basic principles EditKey concepts Edit Poster promoting information security by the Russian Ministry of Defence The CIA triad of confidentiality integrity and availability is at the heart of information security 79 The members of the classic InfoSec triad confidentiality integrity and availability are interchangeably referred to in the literature as security attributes properties security goals fundamental aspects information criteria critical information characteristics and basic building blocks 80 However debate continues about whether or not this CIA triad is sufficient to address rapidly changing technology and business requirements with recommendations to consider expanding on the intersections between availability and confidentiality as well as the relationship between security and privacy 24 Other principles such as accountability have sometimes been proposed it has been pointed out that issues such as non repudiation do not fit well within the three core concepts 81 The triad seems to have first been mentioned in a NIST publication in 1977 82 In 1992 and revised in 2002 the OECD s Guidelines for the Security of Information Systems and Networks 83 proposed the nine generally accepted principles awareness responsibility response ethics democracy risk assessment security design and implementation security management and reassessment 84 Building upon those in 2004 the NIST s Engineering Principles for Information Technology Security 81 proposed 33 principles From each of these derived guidelines and practices In 1998 Donn Parker proposed an alternative model for the classic CIA triad that he called the six atomic elements of information The elements are confidentiality possession integrity authenticity availability and utility The merits of the Parkerian Hexad are a subject of debate amongst security professionals 85 In 2011 The Open Group published the information security management standard O ISM3 86 This standard proposed an operational definition of the key concepts of security with elements called security objectives related to access control 9 availability 3 data quality 1 compliance and technical 4 In 2009 DoD Software Protection Initiative Archived 2016 09 25 at the Wayback Machine released the Three Tenets of Cybersecurity Archived 2020 05 10 at the Wayback Machine which are System Susceptibility Access to the Flaw and Capability to Exploit the Flaw 87 88 89 Neither of these models are widely adopted Confidentiality Edit In information security confidentiality is the property that information is not made available or disclosed to unauthorized individuals entities or processes 90 While similar to privacy the two words are not interchangeable Rather confidentiality is a component of privacy that implements to protect our data from unauthorized viewers 91 Examples of confidentiality of electronic data being compromised include laptop theft password theft or sensitive emails being sent to the incorrect individuals 92 Integrity Edit In IT security data integrity means maintaining and assuring the accuracy and completeness of data over its entire lifecycle 93 This means that data cannot be modified in an unauthorized or undetected manner 94 This is not the same thing as referential integrity in databases although it can be viewed as a special case of consistency as understood in the classic ACID model of transaction processing 95 Information security systems typically incorporate controls to ensure their own integrity in particular protecting the kernel or core functions against both deliberate and accidental threats 96 Multi purpose and multi user computer systems aim to compartmentalize the data and processing such that no user or process can adversely impact another the controls may not succeed however as we see in incidents such as malware infections hacks data theft fraud and privacy breaches 97 More broadly integrity is an information security principle that involves human social process and commercial integrity as well as data integrity As such it touches on aspects such as credibility consistency truthfulness completeness accuracy timeliness and assurance 98 Availability Edit For any information system to serve its purpose the information must be available when it is needed 99 This means the computing systems used to store and process the information the security controls used to protect it and the communication channels used to access it must be functioning correctly 100 High availability systems aim to remain available at all times preventing service disruptions due to power outages hardware failures and system upgrades 101 Ensuring availability also involves preventing denial of service attacks such as a flood of incoming messages to the target system essentially forcing it to shut down 102 In the realm of information security availability can often be viewed as one of the most important parts of a successful information security program citation needed Ultimately end users need to be able to perform job functions by ensuring availability an organization is able to perform to the standards that an organization s stakeholders expect 103 This can involve topics such as proxy configurations outside web access the ability to access shared drives and the ability to send emails 104 Executives oftentimes do not understand the technical side of information security and look at availability as an easy fix but this often requires collaboration from many different organizational teams such as network operations development operations incident response and policy change management 105 A successful information security team involves many different key roles to mesh and align for the CIA triad to be provided effectively 106 Non repudiation Edit In law non repudiation implies one s intention to fulfill their obligations to a contract It also implies that one party of a transaction cannot deny having received a transaction nor can the other party deny having sent a transaction 107 It is important to note that while technology such as cryptographic systems can assist in non repudiation efforts the concept is at its core a legal concept transcending the realm of technology 108 It is not for instance sufficient to show that the message matches a digital signature signed with the sender s private key and thus only the sender could have sent the message and nobody else could have altered it in transit data integrity 109 The alleged sender could in return demonstrate that the digital signature algorithm is vulnerable or flawed or allege or prove that his signing key has been compromised 110 The fault for these violations may or may not lie with the sender and such assertions may or may not relieve the sender of liability but the assertion would invalidate the claim that the signature necessarily proves authenticity and integrity As such the sender may repudiate the message because authenticity and integrity are pre requisites for non repudiation 111 Risk management EditMain article Risk management Broadly speaking risk is the likelihood that something bad will happen that causes harm to an informational asset or the loss of the asset 112 A vulnerability is a weakness that could be used to endanger or cause harm to an informational asset A threat is anything man made or act of nature that has the potential to cause harm 113 The likelihood that a threat will use a vulnerability to cause harm creates a risk When a threat does use a vulnerability to inflict harm it has an impact 114 In the context of information security the impact is a loss of availability integrity and confidentiality and possibly other losses lost income loss of life loss of real property 115 The Certified Information Systems Auditor CISA Review Manual 2006 defines risk management as the process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives and deciding what countermeasures 116 if any to take in reducing risk to an acceptable level based on the value of the information resource to the organization 117 There are two things in this definition that may need some clarification First the process of risk management is an ongoing iterative process It must be repeated indefinitely The business environment is constantly changing and new threats and vulnerabilities emerge every day 118 Second the choice of countermeasures controls used to manage risks must strike a balance between productivity cost effectiveness of the countermeasure and the value of the informational asset being protected 119 Furthermore these processes have limitations as security breaches are generally rare and emerge in a specific context which may not be easily duplicated 120 Thus any process and countermeasure should itself be evaluated for vulnerabilities 121 It is not possible to identify all risks nor is it possible to eliminate all risk The remaining risk is called residual risk 122 A risk assessment is carried out by a team of people who have knowledge of specific areas of the business 123 Membership of the team may vary over time as different parts of the business are assessed 124 The assessment may use a subjective qualitative analysis based on informed opinion or where reliable dollar figures and historical information is available the analysis may use quantitative analysis Research has shown that the most vulnerable point in most information systems is the human user operator designer or other human 125 The ISO IEC 27002 2005 Code of practice for information security management recommends the following be examined during a risk assessment security policy organization of information security asset management human resources security physical and environmental security communications and operations management access control information systems acquisition development and maintenance information security incident management business continuity management regulatory compliance In broad terms the risk management process consists of 126 127 Identification of assets and estimating their value Include people buildings hardware software data electronic print other supplies 128 Conduct a threat assessment Include Acts of nature acts of war accidents malicious acts originating from inside or outside the organization 129 Conduct a vulnerability assessment and for each vulnerability calculate the probability that it will be exploited Evaluate policies procedures standards training physical security quality control technical security 130 Calculate the impact that each threat would have on each asset Use qualitative analysis or quantitative analysis 131 Identify select and implement appropriate controls Provide a proportional response Consider productivity cost effectiveness and value of the asset 132 Evaluate the effectiveness of the control measures Ensure the controls provide the required cost effective protection without discernible loss of productivity 133 For any given risk management can choose to accept the risk based upon the relative low value of the asset the relative low frequency of occurrence and the relative low impact on the business 134 Or leadership may choose to mitigate the risk by selecting and implementing appropriate control measures to reduce the risk In some cases the risk can be transferred to another business by buying insurance or outsourcing to another business 135 The reality of some risks may be disputed In such cases leadership may choose to deny the risk 136 Security controls Edit Main article security controls Selecting and implementing proper security controls will initially help an organization bring down risk to acceptable levels 137 Control selection should follow and should be based on the risk assessment 138 Controls can vary in nature but fundamentally they are ways of protecting the confidentiality integrity or availability of information ISO IEC 27001 has defined controls in different areas 139 Organizations can implement additional controls according to requirement of the organization 140 ISO IEC 27002 offers a guideline for organizational information security standards 141 Administrative Edit Administrative controls also called procedural controls consist of approved written policies procedures standards and guidelines Administrative controls form the framework for running the business and managing people 142 They inform people on how the business is to be run and how day to day operations are to be conducted Laws and regulations created by government bodies are also a type of administrative control because they inform the business 143 Some industry sectors have policies procedures standards and guidelines that must be followed the Payment Card Industry Data Security Standard 144 PCI DSS required by Visa and MasterCard is such an example Other examples of administrative controls include the corporate security policy password policy hiring policies and disciplinary policies 145 Administrative controls form the basis for the selection and implementation of logical and physical controls Logical and physical controls are manifestations of administrative controls which are of paramount importance 142 Logical Edit Logical controls also called technical controls use software and data to monitor and control access to information and computing systems citation needed Passwords network and host based firewalls network intrusion detection systems access control lists and data encryption are examples of logical controls 146 An important logical control that is frequently overlooked is the principle of least privilege which requires that an individual program or system process not be granted any more access privileges than are necessary to perform the task 147 A blatant example of the failure to adhere to the principle of least privilege is logging into Windows as user Administrator to read email and surf the web Violations of this principle can also occur when an individual collects additional access privileges over time 148 This happens when employees job duties change employees are promoted to a new position or employees are transferred to another department 149 The access privileges required by their new duties are frequently added onto their already existing access privileges which may no longer be necessary or appropriate 150 Physical Edit Physical controls monitor and control the environment of the work place and computing facilities 151 They also monitor and control access to and from such facilities and include doors locks heating and air conditioning smoke and fire alarms fire suppression systems cameras barricades fencing security guards cable locks etc Separating the network and workplace into functional areas are also physical controls 152 An important physical control that is frequently overlooked is separation of duties which ensures that an individual can not complete a critical task by himself 153 For example an employee who submits a request for reimbursement should not also be able to authorize payment or print the check 154 An applications programmer should not also be the server administrator or the database administrator these roles and responsibilities must be separated from one another 155 Defense in depth Edit The onion model of defense in depth Main article Defense in depth computing Information security must protect information throughout its lifespan from the initial creation of the information on through to the final disposal of the information 156 The information must be protected while in motion and while at rest During its lifetime information may pass through many different information processing systems and through many different parts of information processing systems 157 There are many different ways the information and information systems can be threatened To fully protect the information during its lifetime each component of the information processing system must have its own protection mechanisms 158 The building up layering on and overlapping of security measures is called defense in depth 159 In contrast to a metal chain which is famously only as strong as its weakest link the defense in depth strategy aims at a structure where should one defensive measure fail other measures will continue to provide protection 160 Recall the earlier discussion about administrative controls logical controls and physical controls The three types of controls can be used to form the basis upon which to build a defense in depth strategy 142 With this approach defense in depth can be conceptualized as three distinct layers or planes laid one on top of the other 161 Additional insight into defense in depth can be gained by thinking of it as forming the layers of an onion with data at the core of the onion people the next outer layer of the onion and network security host based security and application security forming the outermost layers of the onion 162 Both perspectives are equally valid and each provides valuable insight into the implementation of a good defense in depth strategy 163 Classification Edit An important aspect of information security and risk management is recognizing the value of information and defining appropriate procedures and protection requirements for the information 164 Not all information is equal and so not all information requires the same degree of protection 165 This requires information to be assigned a security classification 166 The first step in information classification is to identify a member of senior management as the owner of the particular information to be classified Next develop a classification policy 167 The policy should describe the different classification labels define the criteria for information to be assigned a particular label and list the required security controls for each classification 168 Some factors that influence which classification information should be assigned include how much value that information has to the organization how old the information is and whether or not the information has become obsolete 169 Laws and other regulatory requirements are also important considerations when classifying information 170 The Information Systems Audit and Control Association ISACA and its Business Model for Information Security also serves as a tool for security professionals to examine security from a systems perspective creating an environment where security can be managed holistically allowing actual risks to be addressed 171 The type of information security classification labels selected and used will depend on the nature of the organization with examples being 168 In the business sector labels such as Public Sensitive Private Confidential In the government sector labels such as Unclassified Unofficial Protected Confidential Secret Top Secret and their non English equivalents 172 In cross sectoral formations the Traffic Light Protocol which consists of White Green Amber and Red All employees in the organization as well as business partners must be trained on the classification schema and understand the required security controls and handling procedures for each classification 173 The classification of a particular information asset that has been assigned should be reviewed periodically to ensure the classification is still appropriate for the information and to ensure the security controls required by the classification are in place and are followed in their right procedures 174 Access control Edit Access to protected information must be restricted to people who are authorized to access the information 175 The computer programs and in many cases the computers that process the information must also be authorized 176 This requires that mechanisms be in place to control the access to protected information 176 The sophistication of the access control mechanisms should be in parity with the value of the information being protected the more sensitive or valuable the information the stronger the control mechanisms need to be 177 The foundation on which access control mechanisms are built start with identification and authentication 178 Access control is generally considered in three steps identification authentication and authorization 179 92 Identification Edit Identification is an assertion of who someone is or what something is If a person makes the statement Hello my name is John Doe they are making a claim of who they are 180 However their claim may or may not be true Before John Doe can be granted access to protected information it will be necessary to verify that the person claiming to be John Doe really is John Doe 181 Typically the claim is in the form of a username By entering that username you are claiming I am the person the username belongs to 182 Authentication Edit Authentication is the act of verifying a claim of identity When John Doe goes into a bank to make a withdrawal he tells the bank teller he is John Doe a claim of identity 183 The bank teller asks to see a photo ID so he hands the teller his driver s license 184 The bank teller checks the license to make sure it has John Doe printed on it and compares the photograph on the license against the person claiming to be John Doe 185 If the photo and name match the person then the teller has authenticated that John Doe is who he claimed to be Similarly by entering the correct password the user is providing evidence that he she is the person the username belongs to 186 There are three different types of information that can be used for authentication 187 188 Something you know things such as a PIN a password or your mother s maiden name 189 190 Something you have a driver s license or a magnetic swipe card 191 192 Something you are biometrics including palm prints fingerprints voice prints and retina eye scans 193 Strong authentication requires providing more than one type of authentication information two factor authentication 194 The username is the most common form of identification on computer systems today and the password is the most common form of authentication 195 Usernames and passwords have served their purpose but they are increasingly inadequate 196 Usernames and passwords are slowly being replaced or supplemented with more sophisticated authentication mechanisms such as Time based One time Password algorithms 197 Authorization Edit After a person program or computer has successfully been identified and authenticated then it must be determined what informational resources they are permitted to access and what actions they will be allowed to perform run view create delete or change 198 This is called authorization Authorization to access information and other computing services begins with administrative policies and procedures 199 The policies prescribe what information and computing services can be accessed by whom and under what conditions The access control mechanisms are then configured to enforce these policies 200 Different computing systems are equipped with different kinds of access control mechanisms Some may even offer a choice of different access control mechanisms 201 The access control mechanism a system offers will be based upon one of three approaches to access control or it may be derived from a combination of the three approaches 92 The non discretionary approach consolidates all access control under a centralized administration 202 The access to information and other resources is usually based on the individuals function role in the organization or the tasks the individual must perform 203 204 The discretionary approach gives the creator or owner of the information resource the ability to control access to those resources 202 In the mandatory access control approach access is granted or denied basing upon the security classification assigned to the information resource 175 Examples of common access control mechanisms in use today include role based access control available in many advanced database management systems simple file permissions provided in the UNIX and Windows operating systems 205 Group Policy Objects provided in Windows network systems and Kerberos RADIUS TACACS and the simple access lists used in many firewalls and routers 206 To be effective policies and other security controls must be enforceable and upheld Effective policies ensure that people are held accountable for their actions 207 The U S Treasury s guidelines for systems processing sensitive or proprietary information for example states that all failed and successful authentication and access attempts must be logged and all access to information must leave some type of audit trail 208 Also the need to know principle needs to be in effect when talking about access control This principle gives access rights to a person to perform their job functions 209 This principle is used in the government when dealing with difference clearances 210 Even though two employees in different departments have a top secret clearance they must have a need to know in order for information to be exchanged Within the need to know principle network administrators grant the employee the least amount of privilege to prevent employees from accessing more than what they are supposed to 211 Need to know helps to enforce the confidentiality integrity availability triad Need to know directly impacts the confidential area of the triad 212 Cryptography Edit Main article Cryptography Information security uses cryptography to transform usable information into a form that renders it unusable by anyone other than an authorized user this process is called encryption 213 Information that has been encrypted rendered unusable can be transformed back into its original usable form by an authorized user who possesses the cryptographic key through the process of decryption 214 Cryptography is used in information security to protect information from unauthorized or accidental disclosure while the information is in transit either electronically or physically and while information is in storage 92 Cryptography provides information security with other useful applications as well including improved authentication methods message digests digital signatures non repudiation and encrypted network communications 215 Older less secure applications such as Telnet and File Transfer Protocol FTP are slowly being replaced with more secure applications such as Secure Shell SSH that use encrypted network communications 216 Wireless communications can be encrypted using protocols such as WPA WPA2 or the older and less secure WEP Wired communications such as ITU T G hn are secured using AES for encryption and X 1035 for authentication and key exchange 217 Software applications such as GnuPG or PGP can be used to encrypt data files and email 218 Cryptography can introduce security problems when it is not implemented correctly 219 Cryptographic solutions need to be implemented using industry accepted solutions that have undergone rigorous peer review by independent experts in cryptography 220 The length and strength of the encryption key is also an important consideration 221 A key that is weak or too short will produce weak encryption 221 The keys used for encryption and decryption must be protected with the same degree of rigor as any other confidential information 222 They must be protected from unauthorized disclosure and destruction and they must be available when needed 223 Public key infrastructure PKI solutions address many of the problems that surround key management 92 Process EditThe terms reasonable and prudent person due care and due diligence have been used in the fields of finance securities and law for many years In recent years these terms have found their way into the fields of computing and information security 127 U S Federal Sentencing Guidelines now make it possible to hold corporate officers liable for failing to exercise due care and due diligence in the management of their information systems 224 In the business world stockholders customers business partners and governments have the expectation that corporate officers will run the business in accordance with accepted business practices and in compliance with laws and other regulatory requirements This is often described as the reasonable and prudent person rule A prudent person takes due care to ensure that everything necessary is done to operate the business by sound business principles and in a legal ethical manner A prudent person is also diligent mindful attentive ongoing in their due care of the business In the field of information security Harris 225 offers the following definitions of due care and due diligence Due care are steps that are taken to show that a company has taken responsibility for the activities that take place within the corporation and has taken the necessary steps to help protect the company its resources and employees 226 And Due diligence are the continual activities that make sure the protection mechanisms are continually maintained and operational 227 Attention should be made to two important points in these definitions 228 229 First in due care steps are taken to show this means that the steps can be verified measured or even produce tangible artifacts 230 231 Second in due diligence there are continual activities this means that people are actually doing things to monitor and maintain the protection mechanisms and these activities are ongoing 232 Organizations have a responsibility with practicing duty of care when applying information security The Duty of Care Risk Analysis Standard DoCRA 233 provides principles and practices for evaluating risk 234 It considers all parties that could be affected by those risks 235 DoCRA helps evaluate safeguards if they are appropriate in protecting others from harm while presenting a reasonable burden 236 With increased data breach litigation companies must balance security controls compliance and its mission 237 Security governance Edit See also Information Security Governance The Software Engineering Institute at Carnegie Mellon University in a publication titled Governing for Enterprise Security GES Implementation Guide defines characteristics of effective security governance These include 238 An enterprise wide issue Leaders are accountable Viewed as a business requirement Risk based Roles responsibilities and segregation of duties defined Addressed and enforced in policy Adequate resources committed Staff aware and trained A development life cycle requirement Planned managed measurable and measured Reviewed and auditedIncident response plans Edit This section needs expansion You can help by adding to it January 2018 An incident response plan IRP is a group of policies that dictate an organizations reaction to a cyber attack Once an security breach has been identified for example by Network Intrusion Dection System NIDS or Host Based Intrusion Detection System HIDS if configured to do so the plan is initiated 239 It is important to note that there can be legal implications to a data breach Knowing local and federal laws is critical 240 Every plan is unique to the needs of the organization and it can involve skill sets that are not part of an IT team 241 For example a lawyer may be included in the response plan to help navigate legal implications to a data breach citation needed As mentioned above every plan is unique but most plans will include the following 242 Preparation Edit Good preparation includes the development of an Incident Response Team IRT 243 Skills need to be used by this team would be penetration testing computer forensics network security etc 244 This team should also keep track of trends in cybersecurity and modern attack strategies 245 A training program for end users is important as well as most modern attack strategies target users on the network 242 Identification Edit This part of the incident response plan identifies if there was a security event 246 When an end user reports information or an admin notices irregularities an investigation is launched An incident log is a crucial part of this step 247 All of the members of the team should be updating this log to ensure that information flows as fast as possible 248 If it has been identified that a security breach has occurred the next step should be activated 249 Containment Edit In this phase the IRT works to isolate the areas that the breach took place to limit the scope of the security event 250 During this phase it is important to preserve information forensically so it can be analyzed later in the process 251 Containment could be as simple as physically containing a server room or as complex as segmenting a network to not allow the spread of a virus 252 Eradication Edit This is where the threat that was identified is removed from the affected systems 253 This could include deleting malicious files terminating compromised accounts or deleting other components 254 255 Some events do not require this step however it is important to fully understand the event before moving to this step 256 This will help to ensure that the threat is completely removed 252 Recovery Edit This stage is where the systems are restored back to original operation 257 This stage could include the recovery of data changing user access information or updating firewall rules or policies to prevent a breach in the future 258 259 Without executing this step the system could still be vulnerable to future security threats 252 Lessons Learned Edit In this step information that has been gathered during this process is used to make future decisions on security 260 This step is crucial to the ensure that future events are prevented Using this information to further train admins is critical to the process 261 This step can also be used to process information that is distributed from other entities who have experienced a security event 262 Change management Edit Main article Change Management ITSM Change management is a formal process for directing and controlling alterations to the information processing environment 263 264 This includes alterations to desktop computers the network servers and software 265 The objectives of change management are to reduce the risks posed by changes to the information processing environment and improve the stability and reliability of the processing environment as changes are made 266 It is not the objective of change management to prevent or hinder necessary changes from being implemented 267 268 Any change to the information processing environment introduces an element of risk 269 Even apparently simple changes can have unexpected effects 270 One of management s many responsibilities is the management of risk 271 272 Change management is a tool for managing the risks introduced by changes to the information processing environment 273 Part of the change management process ensures that changes are not implemented at inopportune times when they may disrupt critical business processes or interfere with other changes being implemented 274 Not every change needs to be managed 275 276 Some kinds of changes are a part of the everyday routine of information processing and adhere to a predefined procedure which reduces the overall level of risk to the processing environment 277 Creating a new user account or deploying a new desktop computer are examples of changes that do not generally require change management 278 However relocating user file shares or upgrading the Email server pose a much higher level of risk to the processing environment and are not a normal everyday activity 279 The critical first steps in change management are a defining change and communicating that definition and b defining the scope of the change system 280 Change management is usually overseen by a change review board composed of representatives from key business areas 281 security networking systems administrators database administration application developers desktop support and the help desk 282 The tasks of the change review board can be facilitated with the use of automated work flow application 283 The responsibility of the change review board is to ensure the organization s documented change management procedures are followed 284 The change management process is as follows 285 Request Anyone can request a change 286 287 The person making the change request may or may not be the same person that performs the analysis or implements the change 288 289 When a request for change is received it may undergo a preliminary review to determine if the requested change is compatible with the organizations business model and practices and to determine the amount of resources needed to implement the change 290 Approve Management runs the business and controls the allocation of resources therefore management must approve requests for changes and assign a priority for every change 291 Management might choose to reject a change request if the change is not compatible with the business model industry standards or best practices 292 293 Management might also choose to reject a change request if the change requires more resources than can be allocated for the change 294 Plan Planning a change involves discovering the scope and impact of the proposed change analyzing the complexity of the change allocation of resources and developing testing and documenting both implementation and back out plans 295 Need to define the criteria on which a decision to back out will be made 296 Test Every change must be tested in a safe test environment which closely reflects the actual production environment before the change is applied to the production environment 297 The backout plan must also be tested 298 Schedule Part of the change review board s responsibility is to assist in the scheduling of changes by reviewing the proposed implementation date for potential conflicts with other scheduled changes or critical business activities 299 Communicate Once a change has been scheduled it must be communicated 300 The communication is to give others the opportunity to remind the change review board about other changes or critical business activities that might have been overlooked when scheduling the change 301 The communication also serves to make the help desk and users aware that a change is about to occur 302 Another responsibility of the change review board is to ensure that scheduled changes have been properly communicated to those who will be affected by the change or otherwise have an interest in the change 303 304 Implement At the appointed date and time the changes must be implemented 305 306 Part of the planning process was to develop an implementation plan testing plan and a back out plan 307 308 If the implementation of the change should fail or the post implementation testing fails or other drop dead criteria have been met the back out plan should be implemented 309 Document All changes must be documented 310 311 The documentation includes the initial request for change its approval the priority assigned to it the implementation 312 testing and back out plans the results of the change review board critique the date time the change was implemented 313 who implemented it and whether the change was implemented successfully failed or postponed 314 315 Post change review The change review board should hold a post implementation review of changes 316 It is particularly important to review failed and backed out changes The review board should try to understand the problems that were encountered and look for areas for improvement 316 Change management procedures that are simple to follow and easy to use can greatly reduce the overall risks created when changes are made to the information processing environment 317 Good change management procedures improve the overall quality and success of changes as they are implemented 318 This is accomplished through planning peer review documentation and communication 319 ISO IEC 20000 The Visible OPS Handbook Implementing ITIL in 4 Practical and Auditable Steps 320 Full book summary 321 and ITIL all provide valuable guidance on implementing an efficient and effective change management program information security 322 Business continuity EditBusiness continuity management BCM concerns arrangements aiming to protect an organization s critical business functions from interruption due to incidents or at least minimize the effects 323 324 BCM is essential to any organization to keep technology and business in line with current threats to the continuation of business as usual 325 The BCM should be included in an organizations risk analysis plan to ensure that all of the necessary business functions have what they need to keep going in the event of any type of threat to any business function 326 It encompasses Analysis of requirements e g identifying critical business functions dependencies and potential failure points potential threats and hence incidents or risks of concern to the organization 327 328 Specification e g maximum tolerable outage periods recovery point objectives maximum acceptable periods of data loss 329 Architecture and design e g an appropriate combination of approaches including resilience e g engineering IT systems and processes for high availability 330 avoiding or preventing situations that might interrupt the business incident and emergency management e g evacuating premises calling the emergency services triage situation 331 assessment and invoking recovery plans recovery e g rebuilding and contingency management generic capabilities to deal positively with whatever occurs using whatever resources are available 332 Implementation e g configuring and scheduling backups data transfers etc duplicating and strengthening critical elements contracting with service and equipment suppliers Testing e g business continuity exercises of various types costs and assurance levels 333 Management e g defining strategies setting objectives and goals planning and directing the work allocating funds people and other resources prioritization relative to other activities team building leadership control motivation and coordination with other business functions and activities 334 e g IT facilities human resources risk management information risk and security operations monitoring the situation checking and updating the arrangements when things change maturing the approach through continuous improvement learning and appropriate investment citation needed Assurance e g testing against specified requirements measuring analyzing and reporting key parameters conducting additional tests reviews and audits for greater confidence that the arrangements will go to plan if invoked 335 Whereas BCM takes a broad approach to minimizing disaster related risks by reducing both the probability and the severity of incidents a disaster recovery plan DRP focuses specifically on resuming business operations as quickly as possible after a disaster 336 A disaster recovery plan invoked soon after a disaster occurs lays out the steps necessary to recover critical information and communications technology ICT infrastructure 337 Disaster recovery planning includes establishing a planning group performing risk assessment establishing priorities developing recovery strategies preparing inventories and documentation of the plan developing verification criteria and procedure and lastly implementing the plan 338 Laws and regulations Edit Privacy International 2007 privacy rankinggreen Protections and safeguardsred Endemic surveillance societies Below is a partial listing of governmental laws and regulations in various parts of the world that have had or will have a significant effect on data processing and information security 339 340 Important industry sector regulations have also been included when they have a significant impact on information security 339 The UK Data Protection Act 1998 makes new provisions for the regulation of the processing of information relating to individuals including the obtaining holding use or disclosure of such information 341 342 The European Union Data Protection Directive EUDPD requires that all E U members adopt national regulations to standardize the protection of data privacy for citizens throughout the E U 343 344 The Computer Misuse Act 1990 is an Act of the U K Parliament making computer crime e g hacking a criminal offense 345 The act has become a model upon which several other countries 346 including Canada and the Republic of Ireland have drawn inspiration from when subsequently drafting their own information security laws 347 348 The E U s Data Retention Directive annulled required internet service providers and phone companies to keep data on every electronic message sent and phone call made for between six months and two years 349 The Family Educational Rights and Privacy Act FERPA 20 U S C 1232 g 34 CFR Part 99 is a U S Federal law that protects the privacy of student education records 350 The law applies to all schools that receive funds under an applicable program of the U S Department of Education 351 Generally schools must have written permission from the parent or eligible student 351 352 in order to release any information from a student s education record 353 The Federal Financial Institutions Examination Council s FFIEC security guidelines for auditors specifies requirements for online banking security 354 The Health Insurance Portability and Accountability Act HIPAA of 1996 requires the adoption of national standards for electronic health care transactions and national identifiers for providers health insurance plans and employers 355 Additionally it requires health care providers insurance providers and employers to safeguard the security and privacy of health data 356 The Gramm Leach Bliley Act of 1999 GLBA also known as the Financial Services Modernization Act of 1999 protects the privacy and security of private financial information that financial institutions collect hold and process 357 Section 404 of the Sarbanes Oxley Act of 2002 SOX requires publicly traded companies to assess the effectiveness of their internal controls for financial reporting in annual reports they submit at the end of each fiscal year 358 Chief information officers are responsible for the security accuracy and the reliability of the systems that manage and report the financial data 359 The act also requires publicly traded companies to engage with independent auditors who must attest to and report on the validity of their assessments 360 The Payment Card Industry Data Security Standard PCI DSS establishes comprehensive requirements for enhancing payment account data security 361 It was developed by the founding payment brands of the PCI Security Standards Council including American Express Discover Financial Services JCB MasterCard Worldwide 362 and Visa International to help facilitate the broad adoption of consistent data security measures on a global basis 363 The PCI DSS is a multifaceted security standard that includes requirements for security management policies procedures network architecture software design and other critical protective measures 364 State security breach notification laws California and many others require businesses nonprofits and state institutions to notify consumers when unencrypted personal information may have been compromised lost or stolen 365 The Personal Information Protection and Electronics Document Act PIPEDA of Canada supports and promotes electronic commerce by protecting personal information that is collected used or disclosed in certain circumstances 366 367 by providing for the use of electronic means to communicate or record information or transactions and by amending the Canada Evidence Act the Statutory Instruments Act and the Statute Revision Act 368 369 370 Greece s Hellenic Authority for Communication Security and Privacy ADAE Law 165 2011 establishes and describes the minimum information security controls that should be deployed by every company which provides electronic communication networks and or services in Greece in order to protect customers confidentiality 371 These include both managerial and technical controls e g log records should be stored for two years 372 Greece s Hellenic Authority for Communication Security and Privacy ADAE Law 205 2013 concentrates around the protection of the integrity and availability of the services and data offered by Greek telecommunication companies 373 The law forces these and other related companies to build deploy and test appropriate business continuity plans and redundant infrastructures 374 The US Department of Defense DoD issued DoD Directive 8570 in 2004 supplemented by DoD Directive 8140 requiring all DoD employees and all DoD contract personnel involved in information assurance roles and activities to earn and maintain various industry Information Technology IT certifications in an effort to ensure that all DoD personnel involved in network infrastructure defense have minimum levels of IT industry recognized knowledge skills and abilities KSA Andersson and Reimers 2019 report these certifications range from CompTIA s A and Security through the ICS2 org s CISSP etc 375 Culture EditDescribing more than simply how security aware employees are information security culture is the ideas customs and social behaviors of an organization that impact information security in both positive and negative ways 376 Cultural concepts can help different segments of the organization work effectively or work against effectiveness towards information security within an organization The way employees think and feel about security and the actions they take can have a big impact on information security in organizations Roer amp Petric 2017 identify seven core dimensions of information security culture in organizations 377 Attitudes Employees feelings and emotions about the various activities that pertain to the organizational security of information 378 Behaviors Actual or intended activities and risk taking actions of employees that have direct or indirect impact on information security Cognition Employees awareness verifiable knowledge and beliefs regarding practices activities and self efficacy relation that are related to information security Communication Ways employees communicate with each other sense of belonging support for security issues and incident reporting Compliance Adherence to organizational security policies awareness of the existence of such policies and the ability to recall the substance of such policies Norms Perceptions of security related organizational conduct and practices that are informally deemed either normal or deviant by employees and their peers e g hidden expectations regarding security behaviors and unwritten rules regarding uses of information communication technologies Responsibilities Employees understanding of the roles and responsibilities they have as a critical factor in sustaining or endangering the security of information and thereby the organization Andersson and Reimers 2014 found that employees often do not see themselves as part of the organization Information Security effort and often take actions that ignore organizational information security best interests 379 Research shows information security culture needs to be improved continuously In Information Security Culture from Analysis to Change authors commented It s a never ending process a cycle of evaluation and change or maintenance To manage the information security culture five steps should be taken pre evaluation strategic planning operative planning implementation and post evaluation 380 Pre Evaluation to identify the awareness of information security within employees and to analyze current security policy Strategic Planning to come up a better awareness program we need to set clear targets Clustering people is helpful to achieve it Operative Planning create a good security culture based on internal communication management buy in security awareness and training programs Implementation should feature commitment of management communication with organizational members courses for all organizational members and commitment of the employees 380 Post evaluation to better gauge the effectiveness of the prior steps and build on continuous improvementSources of standards EditMain article Cyber Security Standards The International Organization for Standardization ISO is an international standards organization organized as a consortium of national standards institutions from 167 countries coordinated through a secretariat in Geneva Switzerland ISO is the world s largest developer of international standards The International Electrotechnical Commission IEC is an international standards organization that deals with electrotechnology and cooperates closely with ISO ISO IEC 15443 Information technology Security techniques A framework for IT security assurance ISO IEC 27002 Information technology Security techniques Code of practice for information security management ISO IEC 20000 Information technology Service management and ISO IEC 27001 Information technology Security techniques Information security management systems Requirements are of particular interest to information security professionals The US National Institute of Standards and Technology NIST is a non regulatory federal agency within the U S Department of Commerce The NIST Computer Security Division develops standards metrics tests and validation programs as well as publishes standards and guidelines to increase secure IT planning implementation management and operation NIST is also the custodian of the U S Federal Information Processing Standard publications FIPS The Internet Society is a professional membership society with more than 100 organizations and over 20 000 individual members in over 180 countries It provides leadership in addressing issues that confront the future of the internet and it is the organizational home for the groups responsible for internet infrastructure standards including the Internet Engineering Task Force IETF and the Internet Architecture Board IAB The ISOC hosts the Requests for Comments RFCs which includes the Official Internet Protocol Standards and the RFC 2196 Site Security Handbook The Information Security Forum ISF is a global nonprofit organization of several hundred leading organizations in financial services manufacturing telecommunications consumer goods government and other areas It undertakes research into information security practices and offers advice in its biannual Standard of Good Practice and more detailed advisories for members The Institute of Information Security Professionals IISP is an independent non profit body governed by its members with the principal objective of advancing the professionalism of information security practitioners and thereby the professionalism of the industry as a whole The institute developed the IISP Skills Framework This framework describes the range of competencies expected of information security and information assurance professionals in the effective performance of their roles It was developed through collaboration between both private and public sector organizations world renowned academics and security leaders 381 The German Federal Office for Information Security in German Bundesamt fur Sicherheit in der Informationstechnik BSI BSI Standards 100 1 to 100 4 are a set of recommendations including methods processes procedures approaches and measures relating to information security 382 The BSI Standard 100 2 IT Grundschutz Methodology describes how information security management can be implemented and operated The standard includes a very specific guide the IT Baseline Protection Catalogs also known as IT Grundschutz Catalogs Before 2005 the catalogs were formerly known as IT Baseline Protection Manual The Catalogs are a collection of documents useful for detecting and combating security relevant weak points in the IT environment IT cluster The collection encompasses as of September 2013 over 4 400 pages with the introduction and catalogs The IT Grundschutz approach is aligned with to the ISO IEC 2700x family The European Telecommunications Standards Institute standardized a catalog of information security indicators headed by the Industrial Specification Group ISG ISI See also EditBackup Capability based security Computer security cybersecurity Data breach Data centric security Enterprise information security architecture Identity based security Information infrastructure Information security audit Information security indicators Information security management Information security standards Information technology Information technology security audit IT risk ITIL security management Kill chain List of computer security certifications Mobile security Network Security Services Privacy engineering Privacy software Privacy enhancing technologies Security bug Security convergence Security information management Security level management Security of Information Act Security service telecommunication Single sign on Verification and validationReferences Edit Curry Michael Marshall Byron Crossler Robert E Correia John 2018 04 25 InfoSec Process Action Model IPAM Systematically Addressing Individual Security Behavior ACM SIGMIS Database The DATABASE for Advances in Information Systems 49 SI 49 66 doi 10 1145 3210530 3210535 ISSN 0095 0033 S2CID 14003960 Joshi Chanchala Singh Umesh Kumar August 2017 Information security risks management framework A step towards mitigating security risks in university network Journal of Information Security and Applications 35 128 137 doi 10 1016 j jisa 2017 06 006 ISSN 2214 2126 Fletcher Martin 14 December 2016 An introduction to information risk The National Archives Retrieved 23 February 2022 SANS Institute Information Security Resources www sans org Retrieved 2020 10 31 This article cites Wikipedia or sources that take information from Wikipedia in a circular manner Please help improve this article by repairing any insufficient attribution if necessary and adding citations to reliable sources Unsourced or poorly sourced material may be challenged and removed Find sources Information security news newspapers books scholar JSTOR October 2022 Learn how and when to remove this template message Daniel Kent Titman Sheridan August 2006 Market Reactions to Tangible and Intangible Information The Journal of Finance 61 4 1605 1643 doi 10 1111 j 1540 6261 2006 00884 x SSRN 414701 Fink Kerstin 2004 Knowledge Potential Measurement and Uncertainty Deutscher Universitatsverlag ISBN 978 3 322 81240 7 OCLC 851734708 Keyser Tobias 2018 04 19 Security policy The Information Governance Toolkit CRC Press pp 57 62 doi 10 1201 9781315385488 13 ISBN 978 1 315 38548 8 retrieved 2021 05 28 Danzig Richard 1995 The big three Our greatest security risks and how to address them DTIC ADA421883 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help Lyu M R Lau L K Y 2000 Firewall security policies testing and performance evaluation Proceedings 24th Annual International Computer Software and Applications Conference COMPSAC2000 IEEE Comput Soc 116 121 doi 10 1109 cmpsac 2000 884700 ISBN 0 7695 0792 1 S2CID 11202223 How the Lack of Data Standardization Impedes Data Driven Healthcare Data Driven Healthcare Hoboken NJ USA John Wiley amp Sons Inc p 29 2015 10 17 doi 10 1002 9781119205012 ch3 ISBN 978 1 119 20501 2 retrieved 2021 05 28 Lent Tom Walsh Bill 2009 Rethinking Green Building Standards for Comprehensive Continuous Improvement Common Ground Consensus Building and Continual Improvement International Standards and Sustainable Building West Conshohocken PA ASTM International pp 1 1 10 doi 10 1520 stp47516s ISBN 978 0 8031 4507 8 retrieved 2021 05 28 a b Cherdantseva Y and Hilton J Information Security and Information Assurance The Discussion about the Meaning Scope and Goals In Organizational Legal and Technological Dimensions of Information System Administrator Almeida F Portela I eds IGI Global Publishing 2013 ISO IEC 27000 2009 E 2009 Information technology Security techniques Information security management systems Overview and vocabulary ISO IEC Committee on National Security Systems National Information Assurance IA Glossary CNSS Instruction No 4009 26 April 2010 ISACA 2008 Glossary of terms 2008 Retrieved from http www isaca org Knowledge Center Documents Glossary glossary pdf Pipkin D 2000 Information security Protecting the global enterprise New York Hewlett Packard Company B McDermott E amp Geer D 2001 Information security is information risk management In Proceedings of the 2001 Workshop on New Security Paradigms NSPW 01 pp 97 104 ACM doi 10 1145 508171 508187 Anderson J M 2003 Why we need a new definition of information security Computers amp Security 22 4 308 313 doi 10 1016 S0167 4048 03 00407 3 Venter H S Eloff J H P 2003 A taxonomy for information security technologies Computers amp Security 22 4 299 307 doi 10 1016 S0167 4048 03 00406 1 Gold S December 2004 Threats looming beyond the perimeter Information Security Technical Report 9 4 12 14 doi 10 1016 s1363 4127 04 00047 0 ISSN 1363 4127 Parker Donn B January 1993 A Comprehensive List of Threats To Information Information Systems Security 2 2 10 14 doi 10 1080 19393559308551348 ISSN 1065 898X Sullivant John 2016 The Evolving Threat Environment Building a Corporate Culture of Security Elsevier pp 33 50 doi 10 1016 b978 0 12 802019 7 00004 3 ISBN 978 0 12 802019 7 retrieved 2021 05 28 Buchik S S Yudin O K Netrebko R V 2016 12 21 The analysis of methods of determination of functional types of security of the information telecommunication system from an unauthorized access Problems of Informatization and Management 4 56 doi 10 18372 2073 4751 4 13135 ISSN 2073 4751 a b Samonas S Coss D 2014 The CIA Strikes Back Redefining Confidentiality Integrity and Availability in Security Journal of Information System Security 10 3 21 45 Archived from the original on 2018 09 22 Retrieved 2018 01 25 Gartner Says Digital Disruptors Are Impacting All Industries Digital KPIs Are Crucial to Measuring Success Gartner 2 October 2017 Retrieved 25 January 2018 Gartner Survey Shows 42 Percent of CEOs Have Begun Digital Business Transformation Gartner 24 April 2017 Retrieved 25 January 2018 Forte Dario Power Richard December 2007 Baseline controls in some vital but often overlooked areas of your information protection programme Computer Fraud amp Security 2007 12 17 20 doi 10 1016 s1361 3723 07 70170 7 ISSN 1361 3723 Low voltage switchgear and controlgear Device profiles for networked industrial devices BSI British Standards doi 10 3403 bsen61915 retrieved 2021 05 28 Fetzer James Highfill Tina Hossiso Kassu Howells Thomas Strassner Erich Young Jeffrey November 2018 Accounting for Firm Heterogeneity within U S Industries Extended Supply Use Tables and Trade in Value Added using Enterprise and Establishment Level Data Cambridge MA doi 10 3386 w25249 S2CID 169324096 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help Secure estimation subject to cyber stochastic attacks Cloud Control Systems Emerging Methodologies and Applications in Modelling Elsevier 373 404 2020 doi 10 1016 b978 0 12 818701 2 00021 4 ISBN 978 0 12 818701 2 S2CID 240746156 retrieved 2021 05 28 Nijmeijer H 2003 Synchronization of mechanical systems World Scientific ISBN 978 981 279 497 0 OCLC 262846185 Chapter 1 How students use of computers has evolved in recent years dx doi org doi 10 1787 888933277851 Retrieved 2021 05 28 Information technology Security techniques Competence requirements for information security management systems professionals BSI British Standards doi 10 3403 30342674 retrieved 2021 05 29 Information Security Qualifications Fact Sheet PDF IT Governance Retrieved 16 March 2018 Ma Ruiqing Ray March 2016 Flexible Displays Come in Many Forms Information Display 32 2 4 49 doi 10 1002 j 2637 496x 2016 tb00883 x ISSN 0362 0972 Rahim Noor H March 2006 Human Rights and Internal Security in Malaysia Rhetoric and Reality Defense Technical Information Center OCLC 74288358 Kramer David 2018 09 14 Nuclear theft and sabotage threats remain high report warns Physics Today doi 10 1063 pt 6 2 20180914a ISSN 1945 0699 S2CID 240223415 Wilding Edward 2 March 2017 Information risk and security preventing and investigating workplace computer crime ISBN 978 1 351 92755 0 OCLC 1052118207 Stewart James 2012 CISSP Study Guide Canada John Wiley amp Sons pp 255 257 ISBN 978 1 118 31417 3 2 2 Productivity growth has been trending down in many sectors dx doi org doi 10 1787 734700048756 Retrieved 2021 05 28 Identity Theft The Newest Digital Attackking Industry Must Take Seriously Issues in Information Systems 2007 doi 10 48009 2 iis 2007 297 302 ISSN 1529 7314 Wendel Persson Anna Ronnhed Fredrik 2017 IT sakerhet och manniskan De har varldens starkaste mur men porten star alltid pa glant Umea universitet Institutionen for informatik OCLC 1233659973 Enge Eric 5 April 2017 Stone Temple Archived from the original on 27 April 2018 Retrieved 17 November 2017 Cell phones Shao Ruodan Skarlicki Daniel P 2014 Sabotage toward the Customers who Mistreated Employees Scale PsycTESTS Dataset doi 10 1037 t31653 000 Retrieved 2021 05 28 Kitchen Julie June 2008 7side Company Information Company Formations and Property Searches Legal Information Management 8 2 146 doi 10 1017 s1472669608000364 ISSN 1472 6696 S2CID 144325193 Young Courtenay 2018 05 08 Working with panic attacks Help Yourself Towards Mental Health Routledge pp 209 214 doi 10 4324 9780429475474 32 ISBN 978 0 429 47547 4 retrieved 2021 05 28 Introduction Inside the Insider Threat Insider Threats Cornell University Press pp 1 9 2017 12 31 doi 10 7591 9781501705946 003 ISBN 978 1 5017 0594 6 retrieved 2021 05 28 Table 7 7 France Comparison of the profit shares of non financial corporations and non financial corporations plus unincorporated enterprises dx doi org doi 10 1787 888933144055 Retrieved 2021 05 28 How Did it All Come About The Compliance Business and Its Customers Basingstoke Palgrave Macmillan 2012 doi 10 1057 9781137271150 0007 ISBN 978 1 137 27115 0 retrieved 2021 05 28 Gordon Lawrence Loeb Martin November 2002 The Economics of Information Security Investment ACM Transactions on Information and System Security 5 4 438 457 doi 10 1145 581271 581274 S2CID 1500788 Cho Kim Byung Khansa Lara James Tabitha July 2011 Individual Trust and Consumer Risk Perception Journal of Information Privacy and Security 7 3 3 22 doi 10 1080 15536548 2011 10855915 ISSN 1553 6548 S2CID 144643691 Stewart James 2012 CISSP Certified Information Systems Security Professional Study Guide Sixth Edition Canada John Wiley amp Sons Inc pp 255 257 ISBN 978 1 118 31417 3 Gillett John March 1994 The cost benefit of outsourcing assessing the true cost of your outsourcing strategy European Journal of Purchasing amp Supply Management 1 1 45 47 doi 10 1016 0969 7012 94 90042 6 ISSN 0969 7012 2 1 Despite strong growth Austria has lost some ground since the early 1990s dx doi org doi 10 1787 645173688502 Retrieved 2021 05 29 Introduction Caesar Is Dead Long Live Caesar Julius Caesar s Self Created Image and Its Dramatic Afterlife Bloomsbury Academic 2018 doi 10 5040 9781474245784 0005 ISBN 978 1 4742 4578 4 retrieved 2021 05 29 Suetonius Tranquillus Gaius 2008 Lives of the Caesars Oxford World s Classics New York Oxford University Press p 28 ISBN 978 0 19 953756 3 Singh Simon 2000 The Code Book Anchor pp 289 290 ISBN 978 0 385 49532 5 Tan Heng Chuan 2017 Towards trusted and secure communications in a vehicular environment Thesis Nanyang Technological University doi 10 32657 10356 72758 Johnson John 1997 The Evolution of British Sigint 1653 1939 Her Majesty s Stationery Office ASIN B00GYX1GX2 Willison Matthew 14 September 2018 Were Banks Special Contrasting Viewpoints in Mid Nineteenth Century Britain doi 10 2139 ssrn 3249510 S2CID 169606130 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help Ruppert K 2011 Official Secrets Act 1889 New 1911 Amended 1920 1939 1989 In Hastedt G P ed Spies Wiretaps and Secret Operations An Encyclopedia of American Espionage Vol 2 ABC CLIO pp 589 590 ISBN 9781851098088 2 The Clayton Act A consideration of section 2 defining unlawful price discrimination The Federal Anti Trust Law Columbia University Press pp 18 28 1930 12 31 doi 10 7312 dunn93452 003 ISBN 978 0 231 89377 0 retrieved 2021 05 29 Maer Lucinda Gay 30 December 2008 Official Secrecy PDF Federation of American Scientists The Official Secrets Act 1989 which replaced section 2 of the 1911 Act Espionage and Secrecy Routledge Revivals Routledge pp 267 282 2016 06 10 doi 10 4324 9781315542515 21 ISBN 978 1 315 54251 5 retrieved 2021 05 29 Official Secrets Act what it covers when it has been used questioned The Indian Express 2019 03 08 Retrieved 2020 08 07 Singh Gajendra November 2015 Breaking the Chains with Which We were Bound The Interrogation Chamber the Indian National Army and the Negation of Military Identities 1941 1947 Brill s Digital Library of World War I doi 10 1163 2352 3786 dlws1 b9789004211452 019 Retrieved 2021 05 28 Duncanson Dennis June 1982 The scramble to unscramble French Indochina Asian Affairs 13 2 161 170 doi 10 1080 03068378208730070 ISSN 0306 8374 Whitman et al 2017 pp 3 Allied Power Mobilizing Hydro Electricity During Canada S Second World War Allied Power University of Toronto Press pp 1 2 2015 12 31 doi 10 3138 9781442617117 003 ISBN 978 1 4426 1711 7 retrieved 2021 05 29 Glatthaar Joseph T 2011 06 15 Officers and Enlisted Men Soldiering in the Army of Northern Virginia University of North Carolina Press pp 83 96 doi 10 5149 9780807877869 glatthaar 11 ISBN 978 0 8078 3492 3 retrieved 2021 05 28 a b Sebag Montefiore H 2011 Enigma The Battle for the Code Orion p 576 ISBN 9781780221236 Whitman et al 2017 pp 4 5 a b Whitman et al 2017 p 5 Twentieth Century Wisdom for Twenty First Century Communities Thomas Merton The Lutterworth Press pp 160 184 2012 04 26 doi 10 2307 j ctt1cg4k28 13 ISBN 978 0 7188 4069 3 retrieved 2021 05 29 Murphy Richard C 2009 09 01 Building more powerful less expensive supercomputers using Processing In Memory PIM LDRD final report doi 10 2172 993898 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help A Brief History of the Internet www usg edu Retrieved 2020 08 07 Walking through the view of Delft on Internet Computers amp Graphics 25 5 927 October 2001 doi 10 1016 s0097 8493 01 00149 2 ISSN 0097 8493 DeNardis L 2007 Chapter 24 A History of Internet Security In de Leeuw K M M Bergstra J eds The History of Information Security A Comprehensive Handbook Elsevier pp 681 704 ISBN 9780080550589 Perrin Chad 30 June 2008 The CIA Triad Retrieved 31 May 2012 Sandhu Ravi Jajodia Sushil 2000 10 20 Relational Database Security Information Security Management Handbook Four Volume Set Auerbach Publications doi 10 1201 9780203325438 ch120 ISBN 978 0 8493 1068 3 retrieved 2021 05 29 a b Stoneburner G Hayden C Feringa A 2004 Engineering Principles for Information Technology Security PDF csrc nist gov doi 10 6028 NIST SP 800 27rA a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help A J Neumann N Statland and R D Webb 1977 Post processing audit tools and techniques PDF US Department of Commerce National Bureau of Standards pp 11 3 11 4 oecd org PDF Archived from the original PDF on May 16 2011 Retrieved 2014 01 17 GSSP Generally Accepted system Security Principles A trip to abilene Computers amp Security 15 5 417 January 1996 doi 10 1016 0167 4048 96 82630 7 ISSN 0167 4048 Slade Rob ICS 2 Blog Aceituno Vicente Open Information Security Maturity Model Retrieved 12 February 2017 George Cybenko George Cybenko s Personal Home Page PDF Hughes Jeff Cybenko George 21 June 2018 Quantitative Metrics and Risk Assessment The Three Tenets Model of Cybersecurity Technology Innovation Management Review 3 8 Teplow Lily Are Your Clients Falling for These IT Security Myths CHART continuum net Beckers K 2015 Pattern and Security Requirements Engineering Based Establishment of Security Standards Springer p 100 ISBN 9783319166643 Data Privacy and Confidentiality SpringerReference Berlin Heidelberg Springer Verlag 2011 doi 10 1007 springerreference 205286 retrieved 2021 05 29 a b c d e Andress J 2014 The Basics of Information Security Understanding the Fundamentals of InfoSec in Theory and Practice Syngress p 240 ISBN 9780128008126 Boritz J Efrim 2005 IS Practitioners Views on Core Concepts of Information Integrity International Journal of Accounting Information Systems Elsevier 6 4 260 279 doi 10 1016 j accinf 2005 07 001 Hryshko I 2020 Unauthorized Occupation of Land and Unauthorized Construction Concepts and Types of Tactical Means of Investigation International Humanitarian University Herald Jurisprudence 43 180 184 doi 10 32841 2307 1745 2020 43 40 ISSN 2307 1745 Kim Bonn Oh 2000 09 21 Referential Integrity for Database Design High Performance Web Databases Auerbach Publications pp 427 434 doi 10 1201 9781420031560 34 ISBN 978 0 429 11600 1 retrieved 2021 05 29 Pevnev V 2018 Model Threats and Ensure the Integrity of Information Systems and Technologies 2 56 80 95 doi 10 32836 2521 6643 2018 2 56 6 ISSN 2521 6643 Fan Lejun Wang Yuanzhuo Cheng Xueqi Li Jinming Jin Shuyuan 2013 02 26 Privacy theft malware multi process collaboration analysis Security and Communication Networks 8 1 51 67 doi 10 1002 sec 705 ISSN 1939 0114 Completeness Consistency and Integrity of the Data Model Measuring Data Quality for Ongoing Improvement MK Series on Business Intelligence Elsevier 2013 pp e11 e19 doi 10 1016 b978 0 12 397033 6 00030 4 ISBN 978 0 12 397033 6 Retrieved 2021 05 29 Video from SPIE the International Society for Optics and Photonics dx doi org doi 10 1117 12 2266326 5459349132001 Retrieved 2021 05 29 Communication Skills Used by Information Systems Graduates Issues in Information Systems 2005 doi 10 48009 1 iis 2005 311 317 ISSN 1529 7314 Outages of electric power supply resulting from cable failures Boston Edison Company system 1980 07 01 doi 10 2172 5083196 OSTI 5083196 Retrieved 18 January 2022 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help Loukas G Oke G September 2010 August 2009 Protection Against Denial of Service Attacks A Survey PDF Comput J 53 7 1020 1037 doi 10 1093 comjnl bxp078 Archived from the original PDF on 2012 03 24 Retrieved 2015 08 28 Be Able To Perform a Clinical Activity Definitions Qeios 2020 02 02 doi 10 32388 dine5x S2CID 241238722 retrieved 2021 05 29 Ohta Mai Fujii Takeo May 2011 Iterative cooperative sensing on shared primary spectrum for improving sensing ability 2011 IEEE International Symposium on Dynamic Spectrum Access Networks DySPAN IEEE 623 627 doi 10 1109 dyspan 2011 5936257 ISBN 978 1 4577 0177 1 S2CID 15119653 Information technology Information security incident management BSI British Standards doi 10 3403 30387743 retrieved 2021 05 29 Blum Dan 2020 Identify and Align Security Related Roles Rational Cybersecurity for Business Berkeley CA Apress pp 31 60 doi 10 1007 978 1 4842 5952 8 2 ISBN 978 1 4842 5951 1 S2CID 226626983 retrieved 2021 05 29 McCarthy C 2006 Digital Libraries Security and Preservation Considerations In Bidgoli H ed Handbook of Information Security Threats Vulnerabilities Prevention Detection and Management Vol 3 John Wiley amp Sons pp 49 76 ISBN 9780470051214 Information technology Open systems interconnection Security frameworks for open systems BSI British Standards doi 10 3403 01110206u retrieved 2021 05 29 Christofori Ralf 2014 01 01 Thus could it have been Julio Rondo O k Meta Memory Wilhelm Fink Verlag doi 10 30965 9783846757673 003 ISBN 978 3 7705 5767 7 retrieved 2021 05 29 Atkins D May 2021 Use of the Walnut Digital Signature Algorithm with CBOR Object Signing and Encryption COSE doi 10 17487 rfc9021 S2CID 182252627 Retrieved 18 January 2022 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help Le May I 2003 Structural Integrity in the Petrochemical Industry Comprehensive Structural Integrity Elsevier pp 125 149 doi 10 1016 b0 08 043749 4 01001 6 ISBN 978 0 08 043749 1 retrieved 2021 05 29 Sodjahin Amos Champagne Claudia Coggins Frank Gillet Roland 2017 01 11 Leading or lagging indicators of risk The informational content of extra financial performance scores Journal of Asset Management 18 5 347 370 doi 10 1057 s41260 016 0039 y ISSN 1470 8272 S2CID 157485290 Reynolds E H 1995 07 22 Folate has potential to cause harm BMJ 311 6999 257 doi 10 1136 bmj 311 6999 257 ISSN 0959 8138 PMC 2550299 PMID 7503870 Randall Alan 2011 Harm risk and threat Risk and Precaution Cambridge Cambridge University Press pp 31 42 doi 10 1017 cbo9780511974557 003 ISBN 978 0 511 97455 7 retrieved 2021 05 29 Grama J L 2014 Legal Issues in Information Security Jones amp Bartlett Learning p 550 ISBN 9781284151046 Cannon David L 2016 03 04 Audit Process CISA Certified Information Systems Auditor Study Guide Fourth ed pp 139 214 doi 10 1002 9781119419211 ch3 ISBN 9781119056249 CISA Review Manual 2006 Information Systems Audit and Control Association 2006 p 85 ISBN 978 1 933284 15 6 Kadlec Jaroslav 2012 11 02 Two dimensional process modeling 2DPM Business Process Management Journal 18 6 849 875 doi 10 1108 14637151211283320 ISSN 1463 7154 All Countermeasures Have Some Value But No Countermeasure Is Perfect Beyond Fear New York Springer Verlag pp 207 232 2003 doi 10 1007 0 387 21712 6 14 ISBN 0 387 02620 7 retrieved 2021 05 29 Data breaches Deloitte suffers serious hit while more details emerge about Equifax and Yahoo Computer Fraud amp Security 2017 10 1 3 October 2017 doi 10 1016 s1361 3723 17 30086 6 ISSN 1361 3723 Spagnoletti Paolo Resca A 2008 The duality of Information Security Management fighting against predictable and unpredictable threats Journal of Information System Security 4 3 46 62 Yusoff Nor Hashim Yusof Mohd Radzuan 2009 08 04 Managing HSE Risk in Harsh Environment All Days SPE doi 10 2118 122545 ms Baxter Wesley 2010 Sold out how Ottawa s downtown business improvement areas have secured and valorized urban space Thesis Carleton University doi 10 22215 etd 2010 09016 de Souza Andre Lynch Anthony June 2012 Does Mutual Fund Performance Vary over the Business Cycle Cambridge MA doi 10 3386 w18137 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help Kiountouzis E A Kokolakis S A 1996 05 31 Information systems security facing the information society of the 21st century London Chapman amp Hall Ltd ISBN 978 0 412 78120 9 Newsome B 2013 A Practical Introduction to Security and Risk Management SAGE Publications p 208 ISBN 9781483324852 a b Whitman M E Mattord H J 2016 Management of Information Security 5th ed Cengage Learning p 592 ISBN 9781305501256 Hardware Fabrics Adhesives and Other Theatrical Supplies Illustrated Theatre Production Guide Routledge pp 203 232 2013 03 20 doi 10 4324 9780080958392 20 ISBN 978 0 08 095839 2 retrieved 2021 05 29 Reason James 2017 03 02 Perceptions of Unsafe Acts The Human Contribution CRC Press pp 69 103 doi 10 1201 9781315239125 7 ISBN 978 1 315 23912 5 retrieved 2021 05 29 Information Security Procedures and Standards Information Security Policies Procedures and Standards Boca Raton FL Auerbach Publications pp 81 92 2017 03 27 doi 10 1201 9781315372785 5 ISBN 978 1 315 37278 5 retrieved 2021 05 29 Zhuang Haifeng Chen Yu Sheng Xianfu Hong Lili Gao Ruilan Zhuang Xiaofen 25 June 2020 Figure S1 Analysis of the prognostic impact of each single signature gene PeerJ 8 e9437 doi 10 7717 peerj 9437 supp 1 Retrieved 2021 05 29 Standaert B Ethgen O Emerson R A June 2012 CO4 Cost Effectiveness Analysis Appropriate for All Situations Value in Health 15 4 A2 doi 10 1016 j jval 2012 03 015 ISSN 1098 3015 GRP canopies provide cost effective over door protection Reinforced Plastics 40 11 8 November 1996 doi 10 1016 s0034 3617 96 91328 4 ISSN 0034 3617 Figure 2 3 Relative risk of being a low performer depending on personal circumstances 2012 dx doi org doi 10 1787 888933171410 Retrieved 2021 05 29 Stoneburner Gary Goguen Alice Feringa Alexis 2002 NIST SP 800 30 Risk Management Guide for Information Technology Systems doi 10 6028 NIST SP 800 30 Retrieved 18 January 2022 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help May I Choose Can I Choose Oppression and Choice A Theory of Freedom Palgrave Macmillan 2012 doi 10 1057 9781137295026 0007 ISBN 978 1 137 29502 6 retrieved 2021 05 29 Parker Donn B January 1994 A Guide to Selecting and Implementing Security Controls Information Systems Security 3 2 75 86 doi 10 1080 10658989409342459 ISSN 1065 898X Zoccali Carmine Mallamaci Francesca Tripepi Giovanni 2007 09 25 Guest Editor Rajiv Agarwal Cardiovascular Risk Profile Assessment and Medication Control Should Come First Seminars in Dialysis 20 5 405 408 doi 10 1111 j 1525 139x 2007 00317 x ISSN 0894 0959 PMID 17897245 S2CID 33256127 Guide to the Implementation and Auditing of ISMS Controls based on ISO IEC 27001 London BSI British Standards 2013 11 01 doi 10 3403 9780580829109 ISBN 978 0 580 82910 9 Johnson L 2015 Security Controls Evaluation Testing and Assessment Handbook Syngress p 678 ISBN 9780128025642 Information technology Security techniques Mapping the revised editions of ISO IEC 27001 and ISO IEC 27002 BSI British Standards doi 10 3403 30310928 retrieved 2021 05 29 a b c Administrative Controls Occupational Ergonomics CRC Press pp 443 666 2003 03 26 doi 10 1201 9780203507933 6 ISBN 978 0 429 21155 3 retrieved 2021 05 29 Chen J Demers E A Lev B June 2013 How Time of Day Impacts on Business Conversations doi 10 13007 141 Retrieved 18 January 2022 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help CS1 maint multiple names authors list link 44 U S C 3542 b 1 Appendix D Information Security Policy Development for Compliance Auerbach Publications pp 117 136 2013 03 22 doi 10 1201 b13922 12 ISBN 978 1 4665 8058 9 retrieved 2021 05 29 Firewalls Intrusion Detection Systems and Vulnerability Assessment A Superior Conjunction Network Security 2002 9 8 11 September 2002 doi 10 1016 s1353 4858 02 09009 8 ISSN 1353 4858 Ransome J Misra A 2013 Core Software Security Security at the Source CRC Press pp 40 41 ISBN 9781466560956 least privilege principle SpringerReference Berlin Heidelberg Springer Verlag 2011 doi 10 1007 springerreference 17456 retrieved 2021 05 29 Emir Astra September 2018 19 Duties of Ex employees Law Trove doi 10 1093 he 9780198814849 003 0019 ISBN 978 0 19 185251 0 Guide for Information Access Privileges to Health Information ASTM International doi 10 1520 e1986 09 retrieved 2021 05 29 Drury Bill 2009 01 01 Physical environment Control Techniques Drives and Controls Handbook Institution of Engineering and Technology 355 381 doi 10 1049 pbpo057e chb3 ISBN 978 1 84919 013 8 retrieved 2021 05 29 Fire detection and fire alarms systems BSI British Standards doi 10 3403 30266863 retrieved 2021 05 29 Silverman Arnold B November 2001 Employee exit interviews An important but frequently overlooked procedure JOM 53 11 48 Bibcode 2001JOM 53k 48S doi 10 1007 s11837 001 0195 4 ISSN 1047 4838 S2CID 137528079 Many employee pharmacists should be able to benefit The Pharmaceutical Journal 2013 doi 10 1211 pj 2013 11124182 ISSN 2053 6186 Segregation of Duties Control matrix ISACA 2008 Archived from the original on 3 July 2011 Retrieved 2008 09 30 Residents Must Protect Their Private Information JAMA 279 17 1410B 1998 05 06 doi 10 1001 jama 279 17 1410 ISSN 0098 7484 Group Wisdom Support Systems Aggregating the Insights of Many Through Information Technology Issues in Information Systems 2008 doi 10 48009 2 iis 2008 343 350 ISSN 1529 7314 INTERDEPENDENCIES OF INFORMATION SYSTEMS Lessons Learned Critical Information Infrastructure Protection IT Governance Publishing pp 34 37 2018 doi 10 2307 j ctt1xhr7hq 13 ISBN 978 1 84928 958 0 retrieved 2021 05 29 Managing Network Security Network Perimeter Security Auerbach Publications pp 17 66 2003 10 27 doi 10 1201 9780203508046 3 ISBN 978 0 429 21157 7 retrieved 2021 05 29 Kakareka A 2013 Chapter 31 What is Vulnerability Assessment In Vacca J R ed Computer and Information Security Handbook 2nd ed Elsevier pp 541 552 ISBN 9780123946126 Duke P A Howard I P 2012 08 17 Processing vertical size disparities in distinct depth planes Journal of Vision 12 8 10 doi 10 1167 12 8 10 ISSN 1534 7362 PMID 22904355 Security Onion Control Scripts Applied Network Security Monitoring Elsevier 2014 pp 451 456 doi 10 1016 b978 0 12 417208 1 09986 4 ISBN 978 0 12 417208 1 Retrieved 2021 05 29 Metabolomics Provides Valuable Insight for the Study of Durum Wheat A Review dx doi org doi 10 1021 acs jafc 8b07097 s001 Retrieved 2021 05 29 Overview Information Security Policies Procedures and Standards Auerbach Publications 2001 12 20 doi 10 1201 9780849390326 ch1 ISBN 978 0 8493 1137 6 retrieved 2021 05 29 Electrical protection relays Information and requirements for all protection relays BSI British Standards doi 10 3403 bs142 1 retrieved 2021 05 29 Dibattista Joseph D Reimer James D Stat Michael Masucci Giovanni D Biondi Piera Brauwer Maarten De Bunce Michael 6 February 2019 Supplemental Information 4 List of all combined families in alphabetical order assigned in MEGAN vers 5 11 3 PeerJ 7 e6379 doi 10 7717 peerj 6379 supp 4 Retrieved 2021 05 29 Kim Sung Won 2006 03 31 A Quantitative Analysis of Classification Classes and Classified Information Resources of Directory Journal of Information Management 37 1 83 103 doi 10 1633 jim 2006 37 1 083 ISSN 0254 3621 a b Bayuk J 2009 Chapter 4 Information Classification In Axelrod C W Bayuk J L Schutzer D eds Enterprise Information Security and Privacy Artech House pp 59 70 ISBN 9781596931916 Welcome to the Information Age Overload Hoboken NJ USA John Wiley amp Sons Inc pp 43 65 2015 09 11 doi 10 1002 9781119200642 ch5 ISBN 978 1 119 20064 2 retrieved 2021 05 29 Crooks S 2006 102 Case Study When Exposure Control Efforts Override Other Important Design Considerations AIHce 2006 AIHA doi 10 3320 1 2759009 Business Model for Information Security BMIS ISACA Retrieved 25 January 2018 McAuliffe Leo January 1987 Top secret trade secret Accessing and safeguarding restricted information Government Information Quarterly 4 1 123 124 doi 10 1016 0740 624x 87 90068 2 ISSN 0740 624X Khairuddin Ismail Mohd Sidek Shahrul Naim Abdul Majeed Anwar P P Razman Mohd Azraai Mohd Puzi Asmarani Ahmad Yusof Hazlina Md 25 February 2021 Figure 7 Classification accuracy for each model for all features PeerJ Computer Science 7 e379 doi 10 7717 peerj cs 379 fig 7 Retrieved 2021 05 29 Asset Classification Information Security Fundamentals Auerbach Publications pp 327 356 2013 10 16 doi 10 1201 b15573 18 ISBN 978 0 429 13028 1 retrieved 2021 06 01 a b Almehmadi Abdulaziz El Khatib Khalil 2013 Authorized access denied unauthorized access granted Proceedings of the 6th International Conference on Security of Information and Networks SIN 13 Sin 13 New York New York USA ACM Press 363 367 doi 10 1145 2523514 2523612 ISBN 978 1 4503 2498 4 S2CID 17260474 a b Peiss Kathy 2020 The Country of the Mind Must Also Attack Information Hunters Oxford University Press pp 16 39 doi 10 1093 oso 9780190944612 003 0003 ISBN 978 0 19 094461 2 retrieved 2021 06 01 Fugini M G Martella G January 1988 A petri net model of access control mechanisms Information Systems 13 1 53 63 doi 10 1016 0306 4379 88 90026 9 ISSN 0306 4379 Information technology Personal identification ISO compliant driving licence BSI British Standards doi 10 3403 30170670u retrieved 2021 06 01 Santos Omar 2015 Ccna security 210 260 official cert guide Cisco press ISBN 978 1 58720 566 8 OCLC 951897116 What is Assertion ASSERTION TRAINING Abingdon UK Taylor amp Francis pp 1 7 1991 doi 10 4324 9780203169186 chapter one ISBN 978 0 203 28556 5 retrieved 2021 06 01 Doe John 1960 Field Season In Illinois Begins May 2 Soil Horizons 1 2 10 doi 10 2136 sh1960 2 0010 ISSN 2163 2812 Leech M March 1996 Username Password Authentication for SOCKS V5 doi 10 17487 rfc1929 Retrieved 18 January 2022 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help Kirk John Wall Christine 2011 Teller Seller Union Activist Class Formation and Changing Bank Worker Identities Work and Identity London Palgrave Macmillan UK pp 124 148 doi 10 1057 9780230305625 6 ISBN 978 1 349 36871 6 retrieved 2021 06 01 Dewi Mila Nurmala 2020 12 23 Perbandingan Kinerja Teller Kriya Dan Teller Organik Pt Bank Syariah Mandiri Nisbah Jurnal Perbankan Syariah 6 2 75 doi 10 30997 jn v6i2 1932 ISSN 2528 6633 S2CID 234420571 Vile John 2013 License Checks Encyclopedia of the Fourth Amendment Washington DC CQ Press doi 10 4135 9781452234243 n462 ISBN 978 1 60426 589 7 retrieved 2021 06 01 He Said She Said My Ghost Has a Name University of South Carolina Press pp 17 32 doi 10 2307 j ctv6wgjjv 6 ISBN 978 1 61117 827 2 retrieved 2021 05 29 Bacigalupo Sonny A Dixon Linda K Gubbins Simon Kucharski Adam J Drewe Julian A 26 October 2020 Supplemental Information 8 Methods used to monitor different types of contact PeerJ 8 e10221 doi 10 7717 peerj 10221 supp 8 Retrieved 2021 06 01 Igelnik Boris M Zurada Jacek 2013 Efficiency and scalability methods for computational intellect ISBN 978 1 4666 3942 3 OCLC 833130899 The Insurance Superbill Must Have Your Name as the Provider Before You See Your First Client Routledge pp 37 38 2005 01 01 doi 10 4324 9780203020289 11 ISBN 978 0 203 02028 9 retrieved 2021 06 01 Kissell Joe Take Control of Your Passwords ISBN 978 1 4920 6638 5 OCLC 1029606129 New smart Queensland driver license announced Card Technology Today 21 7 5 July 2009 doi 10 1016 s0965 2590 09 70126 4 ISSN 0965 2590 Lawrence Livermore National Laboratory United States Department of Energy Office of Scientific and Technical Information 1995 A human engineering and ergonomic evaluation of the security access panel interface United States Dept of Energy OCLC 727181384 Lee Paul April 2017 Prints charming how fingerprints are trailblazing mainstream biometrics Biometric Technology Today 2017 4 8 11 doi 10 1016 s0969 4765 17 30074 7 ISSN 0969 4765 Two Factor Authentication SpringerReference Berlin Heidelberg Springer Verlag 2011 doi 10 1007 springerreference 546 retrieved 2021 06 01 Figure 1 5 Marriage remains the most common form of partnership among couples 2000 07 dx doi org doi 10 1787 888932392533 Retrieved 2021 06 01 Akpeninor James Ohwofasa 2013 Modern Concepts of Security Bloomington IN AuthorHouse p 135 ISBN 978 1 4817 8232 6 Retrieved 18 January 2018 Richards G April 2012 One Time Password OTP Pre Authentication doi 10 17487 rfc6560 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help Schumacher Dietmar 2016 04 03 Surface geochemical exploration after 85 years What has been accomplished and what more must be done International Conference and Exhibition Barcelona Spain 3 6 April 2016 SEG Global Meeting Abstracts Society of Exploration Geophysicists and American Association of Petroleum Geologists 100 doi 10 1190 ice2016 6522983 1 Authorization And Approval Program Internal Controls Policies and Procedures Hoboken NJ USA John Wiley amp Sons Inc pp 69 72 2015 10 23 doi 10 1002 9781119203964 ch10 ISBN 978 1 119 20396 4 retrieved 2021 06 01 What responses under what conditions Local Policies and the European Social Fund Policy Press pp 81 102 2019 10 02 doi 10 2307 j ctvqc6hn1 12 ISBN 978 1 4473 4652 4 S2CID 241438707 retrieved 2021 06 01 Cheng Liang Zhang Yang Han Zhihui June 2013 Quantitatively Measure Access Control Mechanisms across Different Operating Systems 2013 IEEE 7th International Conference on Software Security and Reliability IEEE 50 59 doi 10 1109 sere 2013 12 ISBN 978 1 4799 0406 8 S2CID 13261344 a b discretionary access control SpringerReference Berlin Heidelberg Springer Verlag 2011 doi 10 1007 springerreference 12629 retrieved 2021 06 01 Individual Subunits of the Glutamate Transporter EAAC1 Homotrimer Function Independently of Each Other dx doi org doi 10 1021 bi050987n s001 Retrieved 2021 06 01 Ellis Ormrod Jeanne 2012 Essentials of educational psychology big ideas to guide effective teaching Pearson ISBN 978 0 13 136727 2 OCLC 663953375 Belim S V Bogachenko N F Kabanov A N November 2018 Severity Level of Permissions in Role Based Access Control 2018 Dynamics of Systems Mechanisms and Machines Dynamics IEEE 1 5 arXiv 1812 11404 doi 10 1109 dynamics 2018 8601460 ISBN 978 1 5386 5941 0 S2CID 57189531 Configuring TACACS and Extended TACACS Securing and Controlling Cisco Routers Auerbach Publications 2002 05 15 doi 10 1201 9781420031454 ch11 ISBN 978 0 8493 1290 8 retrieved 2021 06 01 Developing Effective Security Policies Risk Analysis and Security Countermeasure Selection CRC Press pp 261 274 2009 12 18 doi 10 1201 9781420078718 18 ISBN 978 0 429 24979 2 retrieved 2021 06 01 The Use of Audit Trails to Monitor Key Networks and Systems Should Remain Part of the Computer Security Material Weakness www treasury gov Retrieved 2017 10 06 fixing canadas access to medicines regime what you need to know about bill c398 Human Rights Documents online doi 10 1163 2210 7975 hrd 9902 0152 Retrieved 2021 06 01 Salazar Mary K January 2006 Dealing with Uncertain Risks When to Apply the Precautionary Principle AAOHN Journal 54 1 11 13 doi 10 1177 216507990605400102 ISSN 0891 0162 S2CID 87769508 We Need to Know More About How the Government Censors Its Employees Human Rights Documents Online doi 10 1163 2210 7975 hrd 9970 2016117 Retrieved 2021 06 01 Pournelle Jerry 2004 04 22 1001 Computer Words You Need to Know Oxford University Press doi 10 1093 oso 9780195167757 003 0007 ISBN 978 0 19 516775 7 retrieved 2021 07 30 a href Template Citation html title Template Citation citation a Missing or empty title help Easttom William 2021 Elliptic Curve Cryptography Modern Cryptography Cham Springer International Publishing pp 245 256 doi 10 1007 978 3 030 63115 4 11 ISBN 978 3 030 63114 7 S2CID 234106555 retrieved 2021 06 01 Follman Rebecca 2014 03 01 From Someone Who Has Been There Information Seeking in Mentoring IConference 2014 Proceedings Thesis iSchools doi 10 9776 14322 hdl 1903 14292 ISBN 978 0 9884900 1 7 Weiss Jason 2004 Message Digests Message Authentication Codes and Digital Signatures Java Cryptography Extensions Elsevier pp 101 118 doi 10 1016 b978 012742751 5 50012 8 ISBN 978 0 12 742751 5 retrieved 2021 06 05 Bider D March 2018 Use of RSA Keys with SHA 256 and SHA 512 in the Secure Shell SSH Protocol doi 10 17487 rfc8332 a href Template Cite journal html title Template Cite journal cite journal a Cite journal requires journal help Noh Jaewon Kim Jeehyeong Kwon Giwon Cho Sunghyun October 2016 Secure key exchange scheme for WPA WPA2 PSK using public key cryptography 2016 IEEE International Conference on Consumer Electronics Asia ICCE Asia IEEE 1 4 doi 10 1109 icce asia 2016 7804782 ISBN 978 1 5090 2743 9 S2CID 10595698 Van Buren Roy F May 1990 How you can use the data encryption standard to encrypt your files and data bases ACM SIGSAC Review 8 2 33 39 doi 10 1145 101126 101130 ISSN 0277 920X Bonneau Joseph 2016 Why Buy When You Can Rent Financial Cryptography and Data Security Lecture Notes in Computer Science Berlin Heidelberg Springer Berlin Heidelberg vol 9604 pp 19 26 doi 10 1007 978 3 662 53357 4 2 ISBN 978 3 662 53356 7 retrieved 2021 06 05 Coleman Heather Andron Jeff 2015 08 01 What GIS Experts and Policy Professionals Need to Know about Using Marxan in Multiobjective Planning Processes Ocean Solutions Earth Solutions Esri Press doi 10 17128 9781589483651 2 ISBN 978 1 58948 365 1 retrieved 2021 06 05 a b Key Encryption Key SpringerReference Berlin Heidelberg Springer Verlag 2011 doi 10 1007 springerreference 323 retrieved 2021 06 05 Giri Debasis Barua Prithayan Srivastava P D Jana Biswapati 2010 A Cryptosystem for Encryption and Decryption of Long Confidential Messages Communications in Computer and Information Science Berlin Heidelberg Springer Berlin Heidelberg vol 76 pp 86 96 Bibcode 2010isa conf 86G doi 10 1007 978 3 642 13365 7 9 ISBN 978 3 642 13364 0 retrieved 2021 06 05 Video from SPIE the International Society for Optics and Photonics dx doi org doi 10 1117 12 2266326 5459349132001 Retrieved 2021 06 05 Vallabhaneni S R 2008 Corporate Management Governance and Ethics Best Practices John Wiley amp Sons p 288 ISBN 9780470255803 Shon Harris 2003 All in one CISSP Certification Exam Guide 2nd ed Emeryville California McGraw Hill Osborne ISBN 978 0 07 222966 0 Boncardo Robert 2018 09 20 Jean Claude Milner s Mallarme Nothing Has Taken Place Edinburgh University Press 1 doi 10 3366 edinburgh 9781474429528 003 0005 S2CID 172045429 The Importance of Operational Due Diligence Hedge Fund Operational Due Diligence Hoboken NJ USA John Wiley amp Sons Inc pp 49 67 2015 10 16 doi 10 1002 9781119197485 ch2 ISBN 978 1 119 19748 5 retrieved 2021 06 05 Hall Gaylord C March 1917 Some Important Diagnostic Points the General Practioner sic Should Know About the Nose Southern Medical Journal 10 3 211 doi 10 1097 00007611 191703000 00007 ISSN 0038 4348 Renes J 1999 Landschappen van Maas en Peel een toegepast historisch geografisch onderzoek in het streekplangebied Noord en Midden Limburg Eisma ISBN 90 74252 84 2 OCLC 782897414 Thomas Brook 2017 06 22 Minding Previous Steps Taken Oxford Scholarship Online doi 10 1093 acprof oso 9780190456368 003 0002 ISBN 978 0 19 045639 9 Lundgren Regina E 2018 Risk communication a handbook for communicating environmental safety and health risks ISBN 978 1 119 45613 1 OCLC 1043389392 Jensen Eric Talbot 2020 12 03 Due Diligence in Cyber Activities Due Diligence in the International Legal Order Oxford University Press pp 252 270 doi 10 1093 oso 9780198869900 003 0015 ISBN 978 0 19 886990 0 retrieved 2021 06 05 The Duty of Care Risk Analysis Standard DoCRA Archived from the original on 2018 08 14 Retrieved 2018 08 15 Sutton Adam Cherney Adrian White Rob 2008 Evaluating crime prevention Crime Prevention Cambridge Cambridge University Press pp 70 90 doi 10 1017 cbo9780511804601 006 ISBN 978 0 511 80460 1 retrieved 2021 06 05 Check Erika 2004 09 15 FDA considers antidepressant risks for kids Nature doi 10 1038 news040913 15 ISSN 0028 0836 Auckland Cressida 2017 08 16 Protecting me from my Directive Ensuring Appropriate Safeguards for Advance Directives in Dementia Medical Law Review 26 1 73 97 doi 10 1093 medlaw fwx037 ISSN 0967 0742 PMID 28981694 Takach George S 2016 Preparing for Breach Litigation Data Breach Preparation and Response Elsevier pp 217 230 doi 10 1016 b978 0 12 803451 4 00009 5 ISBN 978 0 12 803451 4 retrieved 2021 06 05 Westby J R Allen J H August 2007 Governing for Enterprise Security GES Implementation Guide PDF Software Engineering Institute Retrieved 25 January 2018 Fowler Kevvie 2016 Developing a Computer Security Incident Response Plan Data Breach Preparation and Response Elsevier pp 49 77 doi 10 1016 b978 0 12 803451 4 00003 4 ISBN 978 0 12 803451 4 retrieved 2021 06 05 Bisogni Fabio 2016 Proving Limits of State Data Breach Notification Laws Is a Federal Law the Most Adequate Solution Journal of Information Policy 6 154 205 doi 10 5325 jinfopoli 6 2016 0154 JSTOR 10 5325 jinfopoli 6 2016 0154 Understanding Plan for Every Part Turbo Flow Productivity Press pp 21 30 2017 07 27 doi 10 1201 b10336 5 ISBN 978 0 429 24603 6 retrieved 2021 06 05 a b Wills Leonard 27 February 2019 A Brief Guide to Handling a Cyber Incident American Bar Association Johnson Leighton R 2014 Part 1 Incident Response Team Computer Incident Response and Forensics Team Management Elsevier pp 17 19 doi 10 1016 b978 1 59749 996 5 00038 8 ISBN 978 1 59749 996 5 retrieved 2021 06 05 Computer Incident Response and Forensics Team Management Network Security 2014 2 4 February 2014 doi 10 1016 s1353 4858 14 70018 2 ISSN 1353 4858 Cybersecurity Threat Landscape and Future Trends Cybersecurity Routledge pp 304 343 2015 04 16 doi 10 1201 b18335 12 ISBN 978 0 429 25639 4 retrieved 2021 06 05 Information technology Security techniques Information security incident management BSI British Standards doi 10 3403 30268878u retrieved 2021 06 05 Investigation of a Flow Step Clogging Incident A Precautionary Note on the Use of THF in Commercial Scale Continuous Process dx doi org doi 10 1021 acs oprd 9b00366 s001 Retrieved 2021 06 05 Turner Tim 2011 09 07 Our Beginning Team Members Who Began the Success Story One Team on All Levels Productivity Press pp 9 36 doi 10 4324 9781466500020 2 ISBN 978 0 429 25314 0 retrieved 2021 06 05 Erlanger Leon 2002 Defensive Strategies PC Magazine p 70 of Belgrade s main street The event took place in absolute Radical Street Performance Routledge pp 81 83 2013 11 05 doi 10 4324 9781315005140 28 ISBN 978 1 315 00514 0 retrieved 2021 06 05 Why Choice Matters So Much and What Can be Done to Preserve It The Manipulation of Choice Palgrave Macmillan 2013 doi 10 1057 9781137313577 0010 ISBN 978 1 137 31357 7 Retrieved 2021 06 05 a b c Computer Security Incident Handling Guide PDF Nist gov 2012 Borgstrom Pernilla Strengbom Joachim Viketoft Maria Bommarco Riccardo 4 April 2016 Table S3 Results from linear mixed models where non signficant sic parameters have not been removed PeerJ 4 e1867 doi 10 7717 peerj 1867 supp 3 Retrieved 2021 06 05 Penfold David 2000 Selecting Copying Moving and Deleting Files and Directories ECDL Module 2 Using the Computer and Managing Files London Springer London pp 86 94 doi 10 1007 978 1 4471 0491 9 6 ISBN 978 1 85233 443 7 retrieved 2021 06 05 Gumus Onur 2018 ASP NET Core 2 Fundamentals Build Cross Platform Apps and Dynamic Web Services with This Server side Web Application Framework Packt Publishing Ltd ISBN 978 1 78953 355 2 OCLC 1051139482 Do the Students Understand What They Are Learning Trouble shooting Your Teaching Routledge pp 36 40 2005 02 25 doi 10 4324 9780203416907 8 ISBN 978 0 203 41690 7 retrieved 2021 06 05 Where Are Films Restored Where Do They Come From and Who Restores Them Film Restoration Palgrave Macmillan 2013 doi 10 1057 9781137328724 0006 ISBN 978 1 137 32872 4 retrieved 2021 06 05 Liao Qi Li Zhen Striegel Aaron 2011 01 24 Could firewall rules be public a game theoretical perspective Security and Communication Networks 5 2 197 210 doi 10 1002 sec 307 ISSN 1939 0114 Boeckman Philip Greenwald David J Von Bismarck Nilufer 2013 Twelfth annual institute on securities regulation in Europe overcoming deal making challenges in the current markets Practising Law Institute ISBN 978 1 4024 1932 4 OCLC 825824220 Figure 1 8 Spending of social security has been growing while self financing has been falling dx doi org doi 10 1787 888932459242 Retrieved 2021 06 05 Information Governance The Crucial First Step Safeguarding Critical E Documents Hoboken NJ USA John Wiley amp Sons Inc pp 13 24 2015 09 19 doi 10 1002 9781119204909 ch2 ISBN 978 1 119 20490 9 retrieved 2021 06 05 He Ying December 1 2017 Challenges of Information Security Incident Learning An Industrial Case Study in a Chinese Healthcare Organization PDF Informatics for Health and Social Care 42 4 394 395 doi 10 1080 17538157 2016 1255629 PMID 28068150 S2CID 20139345 Kampfner Roberto R 1985 Formal specification of information systems requirements Information Processing amp Management 21 5 401 414 doi 10 1016 0306 4573 85 90086 x ISSN 0306 4573 Jenner H A 1995 Assessment of ecotoxicological risks of element leaching from pulverized coal ashes s n OCLC 905474381 Desktop Computers Software Practical Pathology Informatics New York Springer Verlag pp 51 82 2006 doi 10 1007 0 387 28058 8 3 ISBN 0 387 28057 X retrieved 2021 06 05 Wilby R L Orr H G Hedger M Forrow D Blackmore M December 2006 Risks posed by climate change to the delivery of Water Framework Directive objectives in the UK Environment International 32 8 1043 1055 doi 10 1016 j envint 2006 06 017 ISSN 0160 4120 PMID 16857260 Campbell T 2016 Chapter 14 Secure Systems Development Practical Information Security Management A Complete Guide to Planning and Implementation Apress p 218 ISBN 9781484216859 L Koppelman Kent 2011 Understanding human differences multicultural education for a diverse America Pearson Allyn amp Bacon OCLC 1245910610 POST PROCESSING Simple Scene Sensational Shot Routledge pp 128 147 2013 04 12 doi 10 4324 9780240821351 9 ISBN 978 0 240 82135 1 retrieved 2021 06 05 Kumar Binay Mahto Tulsi Kumari Vinita Ravi Binod Kumar Deepmala 2016 Quackery How It Can Prove Fatal Even in Apparently Simple Cases A Case Report Medico Legal Update 16 2 75 doi 10 5958 0974 1283 2016 00063 3 ISSN 0971 720X Priest Sally 2019 02 22 Shared roles and responsibilities in flood risk management Journal of Flood Risk Management 12 1 e12528 doi 10 1111 jfr3 12528 ISSN 1753 318X S2CID 133789858 United States Department of Energy Office of Inspector General Office of Scientific and Technical Information 2009 Audit Report Fire Protection Deficiencies at Los Alamos National Laboratory United States Dept of Energy OCLC 727225166 Toms Elaine G January 1992 Managing change in libraries and information services A systems approach Information Processing amp Management 28 2 281 282 doi 10 1016 0306 4573 92 90052 2 ISSN 0306 4573 Abolhassan Ferri 2003 The Change Management Process Implemented at IDS Scheer Business Process Change Management Berlin Heidelberg Springer Berlin Heidelberg pp 15 22 doi 10 1007 978 3 540 24703 6 2 ISBN 978 3 642 05532 4 retrieved 2021 06 05 Dawson Chris 2020 07 01 Leading Culture Change doi 10 1515 9780804774673 ISBN 9780804774673 S2CID 242348822 McCormick Douglas P 22 March 2016 Family Inc using business principles to maximize your family s wealth ISBN 978 1 119 21976 7 OCLC 945632737 Schuler Rainer August 1995 Some properties of sets tractable under every polynomial time computable distribution Information Processing Letters 55 4 179 184 doi 10 1016 0020 0190 95 00108 o ISSN 0020 0190 Figure 12 2 Share of own account workers who generally do not have more than one client Excel dx doi org doi 10 1787 888933881610 Retrieved 2021 06 05 Multi user file server for DOS LANs Computer Communications 10 3 153 June 1987 doi 10 1016 0140 3664 87 90353 7 ISSN 0140 3664 Defining Organizational Change Organizational Change Oxford UK Wiley Blackwell pp 21 51 2011 04 19 doi 10 1002 9781444340372 ch1 ISBN 978 1 4443 4037 2 retrieved 2021 06 05 Kirchmer Mathias Scheer August Wilhelm 2003 Change Management Key for Business Process Excellence Business Process Change Management Berlin Heidelberg Springer Berlin Heidelberg pp 1 14 doi 10 1007 978 3 540 24703 6 1 ISBN 978 3 642 05532 4 retrieved 2021 06 05 More Josh Stieber Anthony J Liu Chris 2016 Tier 2 Advanced Help Desk Help Desk Supervisor Breaking Into Information Security Elsevier pp 111 113 doi 10 1016 b978 0 12 800783 9 00029 x ISBN 978 0 12 800783 9 retrieved 2021 06 05 An Application of Bayesian Networks in Automated Scoring of Computerized Simulation Tasks Automated Scoring of Complex Tasks in Computer Based Testing Routledge pp 212 264 2006 04 04 doi 10 4324 9780415963572 10 ISBN 978 0 415 96357 2, wikipedia, wiki, book, books, library,

article

, read, download, free, free download, mp3, video, mp4, 3gp, jpg, jpeg, gif, png, picture, music, song, movie, book, game, games.