[Day 1] 2. Information Security and Risk Assessment

Information Security vs Cybersecurity

1. Information Security

Definition: A comprehensive field dedicated to safeguarding all types of information—whether digital, physical, or intangible—from unauthorized access, disclosure, alteration, and destruction.

Scope:

Policies, Procedures, Controls: Implements a variety of policies, procedures, and controls to protect data in various formats.

Intangible Information:

Description: Refers to data without a physical form but with significant value.
Examples:
- Intellectual Property: Patents, trade secrets.
- Digital Data: Software, digital files.
- Sensitive Information: Personal data, business strategies.

Importance: Protecting intangible information is crucial as its loss or theft can have severe consequences despite being invisible.

2. Cybersecurity

Definition: A subset of information security specifically focused on protecting against cyber threats, such as hacking, malware, and phishing.

Focus Areas:

Networks, Devices, Digital Information: Concentrates on securing these elements in online environments.
Data Protection: Ensures the safety of data stored or transmitted via computers and related devices.

Risk Assessment Process

Step 1: Data Classification

Objective: Categorize data from most critical to least critical (e.g., high, medium, low).
Guiding Questions:
1. What happens if this data is publicly disclosed?
2. What are the implications of unauthorized modification?
3. How critical is this data's availability to authorized users?
4. Is this information personal or sensitive?
5. What is the value and relevance of this information over time?

Step 2: Asset Identification

Objective: Identify all organizational assets (both tangible and intangible) that store or manage critical information.

Step 3: Threat Identification

Objective: Identify potential threats to organizational assets.
Types of Threats:
1. Natural Threats: Fire, floods, earthquakes, landslides, etc.
2. Technological Threats: Component failures (e.g., hard disks, routers), HVAC system failures, power outages.
3. Human-Based Threats: Hacking, terrorism, employee misconduct, strikes.

Examples of Threat Statements:

Earthquake damages the data center (Natural; Availability).
Hard disk failure causes data unavailability (Technological; Availability).
Administrator formats servers out of rage (Human; Availability).
Hacker compromises database (Human; Confidentiality).

Threat Agent: The person, system, or event that causes the threat.

Step 4: Risk Assessment

Objective: Evaluate threats based on historical data and industry trends.
Actions:
- Identify all threats using the threat list.
- Prioritize threats by their likelihood and impact.

Step 5: Risk Mitigation

Objective: Implement strategies to reduce or manage risks.
Strategies:
1. Risk Avoidance: Eliminate technologies or processes with high risks.
2. Risk Mitigation: Use security measures like firewalls, IDS, IPS, etc.
3. Risk Transfer: Outsource risks (e.g., use cloud services to mitigate hardware risks).

Legal Documents

Non-Disclosure Agreement (NDA)

Definition: A contract that outlines confidentiality terms for sharing sensitive information.
Purpose: To prevent unauthorized disclosure of trade secrets, strategies, or proprietary data.

Key Elements:

Confidentiality: Defines what is considered confidential.
Obligations: Specifies obligations of the involved parties.
Consequences: States consequences of a breach.
Duration/Termination: Includes duration or termination clauses.

Service Level Agreement (SLA)

Definition: A contract defining service quality, availability, and performance expectations between a provider and customer.
Purpose: To ensure accountability and establish clear service delivery expectations.