INFORMATION SYSTEM SECURITY AUDIT

INFORMATION SYSTEM SECURITY AUDIT: GENERAL MANAGEMENT DR. SILVIA ELALUF-CALDERWOOD FLORIDA INTERNATIONAL UNIVERSITY

2/22/2023

USAID CYBERSECURITY CYBERSECURITY FOR FOR CRITICAL CRITICAL INFRASTRUCTURE INFRASTRUCTURE IN IN UKRAINE UKRAINEACTIVITY ACTIVITY USAID

1

COURSE OVERVIEW DESCRIPTION This course focuses on information security, integrity and privacy techniques. Topics include the nature and challenges of computer security, the relationship between policy and security, the role and application of cryptography, the mechanisms used to implement policies, the methodologies and technologies for assurance and vulnerability analysis and intrusion detection

2/22/2023

USAID CYBERSECURITY FOR CRITICAL INFRASTRUCTURE IN UKRAINE ACTIVITY

2

OUTCOMES • • • • • •

2/22/2023

It is designed to introduce the terminology, technology and its applications.

Enable a clear understanding and knowledge of Security Analyst foundations, and introduce the tool, technologies and programming languages which is used in day today security analyst job role.

Understand the difference between Security Metrics and Audits.

Knowledge on Vulnerability Management Knowledge Know the Information Security Audit Tasks, Reports and Post Auditing Understand Information Security Assessments Knowledge

USAID CYBERSECURITY FOR CRITICAL INFRASTRUCTURE IN UKRAINE ACTIVITY

3

RESOURCES • • •

2/22/2023

Assessing Information Security (strategies, tactics, logic and framework)

by A Vladimirov, K.Gavrilenko, and A.Michajlowski The Art of Computer Virus Research and Defense by Peter Szor.”

Customized Labs to be purchased for practice

USAID CYBERSECURITY FOR CRITICAL INFRASTRUCTURE IN UKRAINE ACTIVITY

4

EVALUATION • • •

For each unit there will be a quiz (5 quizes or 40% grade) Exercise on Audit reporting (30%) Final Exam (30%)

Questions?

2/22/2023

USAID CYBERSECURITY FOR CRITICAL INFRASTRUCTURE IN UKRAINE ACTIVITY

5

         

2/22/2023

Credits: DAI Global LLC.

WEEK1 INFORMATION SECURITY PERFORMANCE METRICS AND AUDIT Security Metrics and Reporting, Common Issues and Variances of Performance Metrics, Introduction to Security Audit, Servers and Storage devices, Infrastructure and Networks, Communication Routes, Information Security Methodologies (Black-box, White-box, Greybox), Phases of Information Security Audit and Strategies, Ethics of an Information Security Auditor etc.

Maintain Healthy, Safe & Secure Working environment (NOS 9003)

USAID CYBERSECURITY FOR CRITICAL INFRASTRUCTURE IN UKRAINE ACTIVITY

6

            

2/22/2023

Credits: DAI Global LLC.

WEEK 2 INFORMATION SECURITY AUDIT TASKS, REPORTS AND POST AUDITING ACTIONS: Pre-audit checklist, Information Gathering, Vulnerability Analysis, External Security Audit, Internal Network Security Audit, Firewall Security Audit, IDS Security Auditing, Social Engineering Security Auditing, Web Application Security Auditing, Information Security Audit Deliverables & Writing Report, Result Analysis, Post Auditing Actions, Report Retention etc.

Provide Data/Information in Standard formats (NOS 9004) USAID CYBERSECURITY FOR CRITICAL INFRASTRUCTURE IN UKRAINE ACTIVITY

7

Credits: DAI Global LLC.

WEEK 3 VULNERABILITY MANAGEMENT • Information Security Vulnerabilities – Threats and Vulnerabilities, • Human-based Social Engineering, • Computer-based Social Engineering, • Social Media Countermeasures, • Vulnerability Management – Vulnerability Scanning, • Testing, • Threat management, • Remediation etc.

2/22/2023

USAID CYBERSECURITY FOR CRITICAL INFRASTRUCTURE IN UKRAINE ACTIVITY

8

• • • • • • and • • • • 2/22/2023

Credits: DAI Global LLC.

WEEK 4 INFORMATION SECURITY ASSESSMENTS Vulnerability Assessment, Classification, Types of Vulnerability Assessment, Vulnerability Assessment Phases, Vulnerability Analysis Stages, Characteristics of a Good Vulnerability Assessment Solutions &Considerations, Vulnerability Assessment Reports – Tools choosing a right Tool, Information Security Risk Assessment, Risk Treatment, Residual Risk, Risk Acceptance, Risk Management Feedback Loops etc.

USAID CYBERSECURITY FOR CRITICAL INFRASTRUCTURE IN UKRAINE ACTIVITY

9

Credits: DAI Global LLC.

WEEK 5/6 VULNERABILITY MANAGEMENT • Introduction to Configuration Management, • Configuration Management Requirements-Plan Control, • Development of configuration Control Policies, • Testing Configuration Management etc.

SUGGESTED READING: 1. https://www.sans.org/readingroom/whitepapers/threats/implementingvulnerability-management-process-34180 2. http://csrc.nist.gov/publications/nistpubs/800-40-Ver2/SP800-40v2.pdf

2/22/2023

USAID CYBERSECURITY FOR CRITICAL INFRASTRUCTURE IN UKRAINE ACTIVITY

10

DR. SILVIA ELALUFCALDERWOOD SELALUFC@FIU.EDU

2/22/2023

USAID USAID CYBERSECURITY CYBERSECURITY FOR FOR CRITICAL CRITICAL INFRASTRUCTURE INFRASTRUCTURE IN IN UKRAINE UKRAINEACTIVITY ACTIVITY

11