A Multilayered Approach to Information Security

<div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBP76UXazG1serNFQ9zPjacpGef7OpR1iowRHpje-FG-Gh9zqEWa2PToaky_xECm0fLjx4Li_nUc56vJq_foPPOgUtOo0E1PQzr_kT6KoNeFLutNLLJDKAg7r3WhLucZrCYywvKTXWuMRB/s1600/confidentiality.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBP76UXazG1serNFQ9zPjacpGef7OpR1iowRHpje-FG-Gh9zqEWa2PToaky_xECm0fLjx4Li_nUc56vJq_foPPOgUtOo0E1PQzr_kT6KoNeFLutNLLJDKAg7r3WhLucZrCYywvKTXWuMRB/s1600/confidentiality.png" /></a></div><span style="font-family: Arial, Helvetica, sans-serif;">Establishing multiple layers of defense is critical to protecting valuable information assets. An effective multilayered defense involves not only defining and defending the system perimeter, but also preempting and deterring attacks, implementing tools that can deflect attacks, and then constantly monitoring for intruders and learning from their methods. Together, these various defense mechanisms provide for an information security strategy which supports the confidentiality, integrity, and availability of the system, while simultaneously mitigating many of the risks inherent in a world that relies so heavily on information and communication technologies. Remember: a layered defense strategy is best!</span><br /><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: Arial,Helvetica,sans-serif;">Many organizational information systems are subjected to a constant barrage of attacks. Fortunately there are also many tools and techniques available that can be used to limit the number of attacks that will be successful. Beginning outside of the boundaries of a system, preemption and external deterrence methods can be used in order to prevent attacks. For those intrusion attempts that make it through the system perimeter, we can use internal deterrence mechanisms and deflection mechanisms. If all else fails and the attack is successful, it is critical to be able to detect the attack and respond to and learn from it as quickly as possible. In so doing, we can contain the damage and limit the likelihood that a similar attack will succeed in the future. A multilayered security strategy thus represents the best chance possible of providing a solid defense against attacks in light of the competing objectives of confidentiality, integrity, and system availability.</span></div>

A Multilayered Approach to Information Security

Establishing multiple layers of defense is critical to protecting valuable information assets. An effective multilayered defense involves no...

Read more »

Physical, Procedural, and Technical Controls in Information Security

<div class="MsoNormal"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTJUCtkIeCrUz2fpKTxBkfH4Kl5eA3GLI3a_RowX3y4H-gc9k82YcSpxSkL_oDOy7UaYzt5C9fiO6soTYme7hV6iVTpygUjYv-231XDM3Y31XouwcTv8r_9aBwjMMKhdEb11m4UnbgfBzT/s1600/controls.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTJUCtkIeCrUz2fpKTxBkfH4Kl5eA3GLI3a_RowX3y4H-gc9k82YcSpxSkL_oDOy7UaYzt5C9fiO6soTYme7hV6iVTpygUjYv-231XDM3Y31XouwcTv8r_9aBwjMMKhdEb11m4UnbgfBzT/s1600/controls.png" /></a><span style="font-family: Arial, Helvetica, sans-serif;">In this post, I will briefly discuss the three major types or categories of controls that can be used to defend information systems – namely (1) physical controls, (2) procedural controls, and (3) technical controls. First, physical controls are those controls which seek to prevent an attack through the use of something tangible. Examples of physical controls include mechanisms such as walls, locks, security guards, security cameras, backup copies or real-time replication of data, and the use of natural or man-made disaster-protection devices such as smoke alarms or fire extinguishers.</span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">In addition to physical controls, information security personnel can also rely upon procedural and administrative controls to protect information systems. Procedural and administrative controls are guidelines or agreements that require or advise people to act in certain ways with the goal of protecting information assets. Procedural and administrative controls include mechanisms such as laws and local regulations, organizational policies, procedures, or guidelines, methods of protecting intellectual property such as copyrights, patents, or trade secrets, and contracts or other documents that govern the relationship between two or more parties.</span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">Finally, we have technical controls. Technical controls are controls or countermeasures that use technology-based contrivances in order to protect information systems from harm. These can include mechanisms such as passwords, access controls for operating systems or application software programs, network protocols, firewalls and intrusion detection systems, encryption technology, network traffic flow regulators, and so forth. When used together, the adoption of these different types of controls allows for the establishment of a layered defense, and provides the best chance possible of preventing information systems from suffering harm.</span></div><div class="MsoNormal"><o:p></o:p></div>

Physical, Procedural, and Technical Controls in Information Security

In this post, I will briefly discuss the three major types or categories of controls that can be used to defend information systems – namely...

Read more »

Using Multiple Controls or Countermeasures for Information Security

<div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">In this post I would like to talk about using multiple controls or countermeasures for information security purposes. To begin, consider a castle in the Middle Ages. You may have noticed that many castles were built in locations that leveraged natural obstacles in order to protect the castle during an attack. A castle, for example, might be built on the edge of a cliff such that there are fewer points of attack. Further, castles often had a surrounding moat -- that is, a man-made band of water surrounding the castle -- which would help to further protect it from attackers. Additional controls might have included a drawbridge, heavy crenellated walls, strong gates, towers, or guards who use passwords. When considered together, it quickly becomes obvious that the defensive strategy used for castles in the Middle Ages was to rely on a multilayered defense, and a similar strategy should be used to defend information assets today. <o:p></o:p></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEI1OpBJedSvfrUHIMO9obvd6qTRT1atOzXEkWAri0XFIcEv5R4cFh6XkPerc-jY-pLJT6ZSHrKQ06YRbzicAiDSo6F8q_VBQxWLSiAuyuEQN_O6MySpYc07Ywd1fiC28hlphpRlXimXU3/s1600/castle.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEI1OpBJedSvfrUHIMO9obvd6qTRT1atOzXEkWAri0XFIcEv5R4cFh6XkPerc-jY-pLJT6ZSHrKQ06YRbzicAiDSo6F8q_VBQxWLSiAuyuEQN_O6MySpYc07Ywd1fiC28hlphpRlXimXU3/s1600/castle.png" /></a></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;"><br /></span></div><div class="MsoNormal"><span style="font-family: Arial, Helvetica, sans-serif;">Whereas castles used controls such as walls, moats, guards, and so forth, information security personnel can use controls such as encryption, software controls, hardware controls, societal and organizational policies and procedures, physical controls, and so forth in order to protect information assets. Just as with the castle, using a single control or countermeasure would almost certainly be insufficient to establish an adequate defense for information assets. Instead, information security personnel should adopt a multilayered approach.</span></div><div class="MsoNormal"><o:p></o:p></div>

Using Multiple Controls or Countermeasures for Information Security

In this post I would like to talk about using multiple controls or countermeasures for information security purposes. To begin, consider a c...

Read more »