1. REAL TIME CONFERENCING SERVICES
1.1. There are theoretical problems, the only reported attacks have been floods, which are easy to deal with. Theoretical problems have a way of eventually becoming actual problems, but these are extremely theoretical (nobody has verified that they are actually exploitable at all) and not very threatening (if they were exploitable, they still wouldn't be catastrophic). Unintentional denial of service can be a real concern with the MBONE, however, because audio and video can use so much bandwidth
1.2. Is a concept involving the battlespace use and management of information and communication technology in pursuit of a competitive advantage over an opponent. Information warfare may involve collection of tactical information, assurances that one's own information is valid, spreading of propaganda or disinformation to demoralize or manipulate[citation needed] the enemy and the public, undermining the quality of opposing force information and denial of information-collection opportunities to opposing forces.
2. SECURITY THREATS
2.1. CATEGORIES
2.1.1. DATA DISCLOSURE
2.1.1.1. The voluntary sharing of any and all information that is considered relevant to a given situation. Disclosure of this type varies, depending on the specific circumstances of the situation. In some cases, disclosure of certain types of information is not required under the terms of prevailing laws and regulations. At other times, failure to engage in proper data disclosure can lead to serious ramifications.
2.1.2. DATA MODIFICATION
2.1.2.1. The statements you use to add , change or delete data are called data modification statement which are a subset of the data manipulation language (DML) statements part of ANSI SQL
2.1.3. DATA AVAILIBILITY
2.1.3.1. A term used by some computer storage manufacturers and storage service providers (SSPs) to describe products and services that ensure that data continues to be available at a required level of performance in situations ranging from normal through "disastrous."
3. ISSUES OF ON-LINE SECURITY
3.1. ACTIVITES
3.1.1. HACKING
3.1.1.1. Hacking is an attempt to exploit a computer system or a private network inside a computer. Simply put, it is the unauthorised access to or control over computer network security systems for some illicit purpose.
3.1.2. CRACKING
3.1.2.1. The process of breaking down certain hydrocarbons into simpler ones of lower boiling points by means of excess heat, distillation under pressure, etc., in order to give a greater yield of low-boiling products than could be obtained by simple distillation.
3.1.3. SPOOFING
3.1.3.1. Imitate (something) while exaggerating its characteristic features for comic effect.
3.1.4. SNIFFING
3.1.4.1. A utility that has been used since the original release of Ethernet. Packet sniffing allows individuals to capture data as it is transmitted over a network. This technique is used by network professionals to diagnose network issues, and by malicious users to capture unencrypted data, like passwords and usernames. If this information is captured in transit, a user can gain access to a system or network.
3.2. INTERNET SERVICES
3.2.1. FILE TRANSFER
3.2.1.1. * The unencrypted file can be accessed by people other than the intended recipient. * The file traverses an unsecured communication medium that is outside your infrastructure or control. * There are no means for determining who has accessed the file during transport or while awaiting delivery (i.e., no audit trail). * There is no way to know if the file integrity is intact if, for example, the file transfer process aborts before it is completed (this is common with FTP). * There are no means to control the lifecycle of the file – how long it is available to the recipient, when it should be deleted, etc.
3.2.2. ELECTRONIC MAIL AND NEWS
3.2.2.1. The transfer agent directly accepts commands (related to transporting mail) from external hosts; for this reason, if the transfer agent isn't secure, it may end up immediately giving an attacker all the access it has itself.
3.2.3. REMOTE ACCESS TO HOST
3.2.3.1. Remote access problems typically include the following: -Connection attempt is rejected when it should be accepted. -Connection attempt is accepted when it should be rejected. -Unable to reach locations beyond the remote access server. -Miscellaneous remote access problems.
3.2.4. INFORMATION THEFT
3.2.4.1. Is a crime in which an imposter obtains key pieces of personally identifiable information, such as Social Security or driver's license numbers, in order to impersonate someone else.
3.3. TERMINOLOGIES
3.3.1. UNAUTHORIZED DISCLOSURE
3.3.1.1. The anti-leak provisions proposed by the Senate Intelligence Committee in the pending FY2013 intelligence authorization act have been widely criticized as misconceived and ill-suited to achieving their presumed goals. But they also suffer from a lack of clarity and an absence of definitions of crucial terms.
3.3.2. INFORMATION WARFARE
3.3.3. ACCIDENTAL DATA LOSS
3.3.3.1. The anti-leak provisions proposed by the Senate Intelligence Committee in the pending FY2013 intelligence authorization act have been widely criticized as misconceived and ill-suited to achieving their presumed goals. But they also suffer from a lack of clarity and an absence of definitions of crucial terms.
4. ROLES OF THE INFORMATION SECURITY
4.1. CERT/CC
4.1.1. The coordination center of the computer emergency response team (CERT) for the Software Engineering Institute (SEI), a non-profit United States federally funded research and development center. The CERT/CC researches software bugs that impact software and internet security, publishes research and information on its findings, and works with business and government to improve security of software and the internet as a whole
4.2. US-CERT
4.2.1. United States Computer Emergency Readiness Team (US-CERT) is an organization within the Department of Homeland Security’s (DHS) National Protection and Programs Directorate (NPPD).
4.2.2. Is responsible for analyzing and reducing cyber threats, vulnerabilities, disseminating cyber threat warning information, and coordinating incident response activities
4.3. SANS INSTITUTE
4.3.1. SANS is the most trusted and by far the largest source for information security training in the world.
4.3.2. International Information System Security Certification Consortium or (ISC)2 is a non-profit organization which specializes in information security education and certification. Support and provide members and constituent with credentials, resource and leadership to address cyber, information. software and infrastructure security to deliver value to society.
4.4. (ISC)2
4.5. COMMON CRITERIA
4.5.1. Common Criteria is and international standard (ISO/IEC 15408) for computer security certification . it is currently in version 3.1 revision 5
4.6. FIPS
4.6.1. Federal Information Processing Standard(FIPS) are publicly announced standards developed by the United States federal government for use in computer system by non-military government agencies and government contractors
4.7. ICSA
4.7.1. International Computer Security Association began as NCSA(Natioanal Computer Security Association.Mission was to increase awareness of the need for computer security. To provide education about various security products and technologies. NCSA focusedalmost solely on the ertification of anti-virussotware
5. Events that could cause serious loss or damage to an enterprise, agency or institution.
6. Is the protection of personnel, hardware, software, networks and data from physical actions
7. INFORMATION SECURITY DEFINITION
7.1. Sometimes shortened to Info Sec ,the state of being protected against the unauthorized use of information, especially electronic data, or the measures taken to achieve this
8. AREAS IN INFORMATION SECURITY
8.1. PHYSICAL SECURITY
8.1.1. Includes protection :
8.1.1.1. Fire, flood, natural disasters, burglary, theft, vandalism and terrorism
8.2. OPERATIONAL SECURITY(OPSEC)
8.2.1. Is the process by which we protect unclassified information that can be used against us.
8.2.2. To look at ourselves through the eyes of an adversary (individual, groups, countries, organizations)
8.2.3. Nearly 90% of the information collected comes from "Open Sources".
8.2.4. objective is to ensure a safe and secure environment
8.2.5. Five-step process to better safety & security
8.2.5.1. 1.Identify critical info
8.2.5.2. 2.Analyze threats
8.2.5.2.1. Involves a set of rules or a promise that limits access or place restriction on certain type of information
8.2.5.3. 3.Analyze vulnerabilities
8.2.5.4. 4. Assess the risk
8.2.5.5. 5.Apply countermeasures
8.3. MANAGEMENT & POLICIES
8.3.1. provides a policy service for creating and managing policies
8.3.2. Policy services allows administrators to define, modify, grant, revoke and delete permissions to protect resources within the Identity Server deployment.
9. GOALS OF INFORMATION SECURITY
9.1. CONFIDENTIALITY
9.1.1. The state of keeping or being kept secret or private
9.2. INTEGRITY
9.2.1. The quality of being honest and having strong moral principles
9.2.2. The state of being whole and undivided
9.3. AVAILABILITY
9.3.1. The quality of being able to be used or obtained
9.3.2. The state of otherwise unoccupied; freedom to do something