网络安全IT security.ppt

M1 Issue 4.0, July 2000 * Assets can be anything of value to an organisation or individual, for example: - bank records, patient details, etc. - information - software - physical components - services - people - the good name of the company/group as a credible organisation In the domain of IT security, however, the assets of interest are normally the information held on an IT system, or the resources provided by the system. Threats may come from many sources or threat agents, for example: - hackers - hostile organisations - disgruntled employees - poorly trained employees - natural disasters - accidental misuse M1 Issue 4.0, July 2000 * Having identified assets that require protection, and the potential threats to those assets, the next step is for the owner of the asset to select appropriate countermeasures. “Horses for Courses” - It is important that the right countermeasure is chosen to reduce the residual risk to an acceptable level, and counter the threat. M1 Issue 4.0, July 2000 * Countermeasures can be broadly categorised according to what they do in order to counter an identified threat - both IT and non-IT countermeasures can be categorised in this way. Note that there is no need to categorise selected countermeasures in this way. Awareness of the three types may help the selection process - by acting as a form of checklist. Once defined, however, it should be clear whether the countermeasure is preventative, detective or corrective. M1 Issue 4.0, July 2000 * Note that “logical access control” refers to access control enforced by an IT system. Other examples can be cited from personal experience, e.g. ask students how identification a