Information System Management and Security
Information System Management and Security tests governance, risk, access control, cryptography, network defense, privacy, and continuity-how an organization runs systems responsibly.
Core rules
- Governance aligns IT with business goals using frameworks such as COBIT and ITIL. Separate duties so one person cannot both request and approve a sensitive change.
- Risk is asset × threat × vulnerability, expressed as likelihood and impact. Treat by avoiding, reducing, transferring, or accepting; record residual risk.
- Access control: DAC lets owners grant access; MAC uses labels and clearances; RBAC grants by role. Apply least privilege, need-to-know, and periodic review. Authentication proves identity; authorization grants permissions.
- Cryptography: symmetric (AES) is fast for bulk data; asymmetric (RSA/ECC) supports key exchange and signatures; hashing (SHA-256) checks integrity but is not encryption. A digital signature uses the sender’s private key and is verified with the public key; PKI binds keys to identities through certificates.
- Network controls: firewall filters traffic, IDS detects, IPS blocks, VPN protects remote transport, DMZ isolates public services. Secure SDLC builds security into requirements, design, code, test, and operations.
- Privacy: minimize collection, obtain consent where required, limit retention, and protect personal data. Incident response needs preparation, detection, containment, eradication, recovery, and lessons learned.
Worked example
A public web application has an admin portal. Place the admin portal behind VPN and MFA, enforce RBAC, put a WAF in front of the public site, encrypt the database at rest, hash passwords with a salted slow hash, and send audit logs to a separate system. These controls reduce credential theft, privilege abuse, and tampering.
Traps
Confusing hashing with encryption; mixing authentication and authorization; saying IDS blocks traffic; treating risk transfer as elimination; collecting personal data “just in case.”