Information Security

1. Even professionals who work in information security do not agree exactly what terms like security, protection, and privacy mean.

2. If you don’t know what you are protecting, why you are protecting it, and what you are protecting it from, your task will be rather difficult.

3. What you need is to understand how to establish and apply uniform security policies.

4. For most organizations, unauthorized access is not a major problem unless it involves one of the other threats: disclosure of information or denial of service.

5. A well-thought-out security plan will help you decide what needs to be protected, how much you are willing to invest in protecting it, and who will be responsible for carrying out the steps to protect it.

6. An insidious aspect of DoS (Denial of Service) appears when your system becomes an unwitting tool of the attackers.

7. We are all familiar with cases where web vandals gain access to a web server and change the data on the server in order to embarrass the organization that runs the web site.

8. Denial of service can be a severe problem if it impacts many users or a major mission of your organization.

9. Some browsers (such as Mozilla Firefox and Opera) have an option to have the system clear cookies automatically whenever the user closes the browser.

10. What information an ISP collects, what it does with that information, and whether it informs its consumers, can pose significant privacy issues.

11. This may include recording times when the computer is in use, or which web sites are visited.

12. Computer security imposes requirements on computers that are different from most system requirements because they often take the form of constraints on what computers are not supposed to do.

13. This makes computer security particularly challenging because we find it hard enough just to make computer programs do everything they are designed to do correctly.

14. Strong authentication techniques can be used to ensure that communication end-points are who they say they are.

15. In 1983, Korean Airlines Flight 007, a Boeing 747 was shot down by Soviet SU-15 jets after a navigation computer malfunction caused the aircraft to steer 185 miles off course into Soviet Union airspace.

16. They inform people on how the business is to be run and how day to day operations are to be conducted.

17. Before ordering a product or service online, the user and the online service provider or merchant negotiate the type of personal data that is to be transferred to the service provider.

18. While this negotiation takes place, the online service provider communicates his requirements about the minimum amount of data he needs to provide the wanted service.

19. A virus is a piece of software designed and written to adversely affect your computer by altering the way it works without your knowledge or permission.

20. A virus that conceals itself until some predetermined date or time and then does nothing more than display some sort of message is considered benign.

21. Additionally, you should evaluate your router logs and examine status information on your routers periodically, to detect networking problems, and eventually change to restrictive or emergency access lists you have previously compiled, for the case that network critical events occur.

22. Another important service which incident response and emergency consulting should offer is informal and anonymous consulting.

23. Because of the decentralized, non-authoritative nature of the Internet, information is being distributed over a variety of different channels, including security organizations, but also news groups, and media sites, which often do not provide reliable and complete information, causing unnecessary panic and paranoia on one hand, and insufficient awareness on the other.

24. Since the first traffic loggers and port scan detectors had been designed, classical intrusion detection has been relying on monitoring network traffic and system events and identifying unusual actions and objects to determine intrusions.

25. When a new protocol architecture is being described, software developers should at least be given hint about where possible caveats and vulnerabilities could be present.