Protection of Information Assets
Security management
Security is a business issue owned by senior management; the CISO advises and coordinates. A classification scheme (owner-assigned) drives handling rules. Core principles: least privilege, need-to-know, defense in depth, and balance - more controls are not automatically better if they break usability.
Access control
Sequence: identification → authentication → authorization → accountability via audit trails. The three factors are something you know, have, or are; true two-factor authentication combines different types. Biometrics: false rejection rate (Type I) rejects a valid user; false acceptance rate (Type II) admits an imposter; the crossover error rate where they meet measures system accuracy - lower is better. MAC uses system-enforced labels and clearances; DAC lets the owner grant access; RBAC ties rights to roles and simplifies transfers. Single sign-on improves usability but concentrates risk.
Cryptography
Symmetric encryption is fast but has key-distribution problems; asymmetric encryption solves key exchange. Hashing is one-way and provides integrity without a key. A digital signature (hash encrypted with the sender's private key) gives integrity, authentication and nonrepudiation - but not confidentiality. PKI relies on a certificate authority and registration authority; a digital envelope combines asymmetric and symmetric for efficiency.
Network and physical
Firewalls, a DMZ for public-facing systems, IDS (detects, passive) versus IPS (blocks), VPNs, segmentation, hardened wireless (current WPA standards, rogue access point detection), malware controls, DLP and security awareness training. Physical: layered perimeter, access logs, environmental controls.
Traps
Claims that digital signatures provide confidentiality, or that encryption delivers availability.
Rule of thumb
If asked what proves a message came from a given sender and was unaltered, the answer is a digital signature.