-
logical security
physical security
premises security
three elements of information system (IS) security
-
logical security
protects computer-based data from software-based and communication-based threats
-
physical security (infrastructure security)
protects the information systems that contain data and the people who use, operate, and maintain the systems and prevent any type of physical access or intrusion
-
premises security (corporate or facilities security)
protects the people and property within an entire area, facility, or building(s), and is usually required by laws
-
information system hardware
includes data processing and storage equipment, transmission and networking facilities, and offline storage media
-
physical facility
the buildings and other structurs housing the system and network components
-
supportingĀ facilities
facilities that underpin the operation of the information system - includes electrical power, communication services, and environmental controls (heat, humidity, etc.)
-
personnel
humans involved in the control, maintenance, and use of the information systems
-
environmental threats
technical threats
human-caused threats
three categories of threats
-
tornado
hurricane
earthquake
ice storm/blizzard
lightning
flood
categories of natural disasters
-
natural disasters
inappropriate temperature and humidity
fire and smoke
water damage
chemical, radiological, and biological hazards
dust
infestation
types of environmental threats
-
environmental threats
category that encompasses conditions in the environment that can damage or interrupt the service of information systems and the data they contain
-
technical threats
category that encompases threats related to electrical power and electromanetic emission
-
electrical power - under/overvoltage, noise
electromagnetic interference
types of technical threats
-
undervoltage
condition that occurs when the IS equipment receives less voltage than is required for normal operation - ex: dip in power supply, brownouts (prolonged), & outages
-
overvoltage
surge of voltageĀ - damage is a function of intensity and duration
-
noise
spurius signals that can endure through the filtering circuitry of the power supply and interfere with signals inside electronic devices, causing logical errors
-
electromagnetic interference
electrical noise that can cause intermittent problems with the computer you are using - or high-intensity emissions from nearby commercial radio stations & microwave relay antennas
-
unauthorized physical access, theft, vandalism, misuse
categories of human-caused physical threats
-
unauthorized physical access
those without the proper authorizationĀ are allowed access to certain portions of a building or complex, and can lead to other threats
-
theft - also includes theft of equipment & theft of data by copying
security threat that includes eavesdropping and wiretapping
-
vandalism
threat that includes destruction of equipment and data
-
misuse
threat that includes improper use of resources by those who are authorized to use them, as well as use of resources by individuals not aurhorized to use the resources at all
-
Personal Identity Verification
PIV
-
access control subsystem
includes components responsible for determining a particular PIV cardholder's access to a physical or logical resource
-
PIV frond end subsystem
supports up to three-factor authentication:
- some confidence - use of card reader & PIN
- high confidence - adds biometric comparison of fingerprint
- very high confidence - adds official observer
-
Card Holder Unique Identifier
CHUID
-
CHUID (Card Holder Unique Identifier)
takes authentication to a new level and includes an expiration date and optional digital signature in addition to the typical card number/facility code encoded on most access control cards
-
biometric authentication (BIO)
authentication implemented by using a fingerprint or iris data object sent from the PIV card to the PACS
-
Physical Access Control System
PACS
-
attended biometric authentication (BIO-A)
authentication mechanism that uses BIO authentication but also uses an attendant to supervise the use of the PIV card and submission of the PIN and the sample biometric by the cardholder
-
PIV authentication key (PKI)
two-factor authentication that requires the cardholder to enter a PIN to unlock the card in order to successfully authenticate
-
card authentication key (CAK)
an optional key that may be present on any PIV card used to authenticate the card and therefore its possessor - may be used on contactless or contact interface, and does not require PIN entry
-
visual (VIS)
cardholder unique identifier (CHUID)
biometric (BIO)
attended biometric (BIO-A)
PIV authentication key (PKI)
card authentication key (CAK)
authentication mechanisms
-
visual (VIS)
authentication done by a human guard - checking to see that the PIV card looks genuine and compares cardholder's facial features to those on the card, checks expiration, etc.
-
1.unrestricted
2. controlled
3. limited
4. exclusion
degrees of security and control for protected areas
-
untrestricted
an area of a facility that has no security interest
-
controlled
that portion of a restricted area usually near or surrounding a limited or exclusion area - restricted to personnel with a need for access
-
limited
restricted area within close proximity of a security interest
-
exclusion
a restricted area containing a security interest
|
|