WHAT IS SECURITY? In general, security is the quality or state of being secure--to be free from danger.

It means to be protected from adversaries--from those who would do harm, intentionally or otherwise. Levels of Security A successful organization should have the following multiple layers of security in place for the protection of its operations: Physical security - to protect the physical items, objects, or areas of an organization from unauthorized access and misuse. Personal security to protect the individual or group of individuals who are authorized to access the organization and its operations. Operations security to protect the details of a particular operation or series of activities. Communications security to protect an organizations communications media, technology, and content. Network security to protect networking components, connections, and contents.

BOTTOM UP APPROACH TO SECURITY IMPLEMENTATION Security can begin as a grass-roots effort when systems administrators attempt to improve the security of their systems. This is referred to as the bottom-up approach. The key advantage of the bottom-up approach is the technical expertise of the individual administrators. Unfortunately, this approach seldom works, as it lacks a number of critical features, such as participant support and organizational staying power. TOP-DOWN APPROACH TO SECURITY IMPLEMENTATION An alternative approach, which has a higher probability of success, is called the top-down approach. The project is initiated by upper management who issue policy, procedures and processes, dictate the goals and expected outcomes of the project, and determine who is accountable for each of the required actions. The top-down approach has strong upper management support, a dedicated champion, dedicated funding, clear planning and the opportunity to influence organizational culture. The most successful top-down approach also involves a formal development strategy referred to as a systems development life cycle.

THE SECURITY SYSTEMS DEVELOPMENT LIFE CYCLE The same phases used in the traditional SDLC can be adapted to support the specialized implementation of a security project. The fundamental process is the identification of specific threats and the creation of specific controls to counter those threats. The SecSDLC unifies the process and makes it a coherent program rather than a series of random, seemingly unconnected actions. Investigation The investigation of the SecSDLC begins with a directive from upper management, dictating the process, outcomes and goals of the project, as well as the constraints placed on the activity. Frequently, this phase begins with a statement of program security policy that outlines the implementation of security. Teams of responsible managers, employees and contractors are organized, problems analyzed, and scope defined, including goals objectives, and constraints not covered in the program policy. Finally, an organizational feasibility analysis is performed to determine whether the organization has the resources and commitment necessary to conduct a successful security analysis and design. Analysis In the analysis phase, the documents from the investigation phase are studied. The development team conducts a preliminary analysis of existing security policies or programs, along with documented current threats and associated controls. This phase also includes an analysis of relevant legal issues that could impact the design of the security solution. The risk management task - identifying, assessing and evaluating the levels of risk facing the organization, also begins in this stage. Logical Design The logical design phase creates and develops the blueprints for security, and examines and implements key policies that influence later decisions. Also at this stage, critical planning is developed for incident response actions to be taken in the event of partial or catastrophic loss. Next, a feasibility analysis determines whether or not the project should continue or should be outsourced.

Physical Design In the physical design phase, the security technology needed to support the blueprint outlined in the logical design is evaluated, alternative solutions generated, and a final design agreed upon. The security blueprint may be revisited to keep it synchronized with the changes needed when the physical design is completed. Criteria needed to determine the definition of successful solutions is also prepared during this phase. Included at this time are the designs for physical security measures to support the proposed technological solutions. At the end of this phase, a feasibility study should determine the readiness of the organization for the proposed project, and then the champion and users are presented with the design. At this time, all parties involved have a chance to approve the project before implementation begins. Implementation The implementation phase is similar to the traditional SDLC. The security solutions are acquired (made or bought), tested, and implemented, and tested again. Personnel issues are evaluated and specific training and education programs conducted. Finally, the entire tested package is presented to upper management for final approval. Maintenance and Change The maintenance and change phase, though last, is perhaps most important, given the high level of ingenuity in todays threats. The reparation and restoration of information is a constant duel with an often-unseen adversary. As new threats emerge and old threats evolve, the information security profile of an organization requires constant adaptation to prevent threats from successfully penetrating sensitive data Security Professionals And The Organization It takes a wide range of professionals to support a diverse information security program. To develop and execute specific security policies and procedures, additional administrative support and technical expertise is required Senior Management Chief Information Officer - the senior technology officer, although other titles such as Vice President of Information, VP of Information Technology, and VP of Systems may be used. The CIO is primarily

responsible for advising the Chief Executive Officer, President or company owner on the strategic planning that affects the management of information in the organization. Chief Information Security Officer - the individual primarily responsible for the assessment, management, and implementation of securing the information in the organization. The CISO may also be referred to as the Manager for Security, the Security Administrator, or a similar title. Security Project Team A number of individuals who are experienced in one or multiple requirements of both the technical and non-technical areas is called security project team. The champion: a senior executive who promotes the project and ensures its support, both financially and administratively, at the highest levels of the organization. The team leader: a project manager, who may be a departmental line manager or staff unit manager, who understands project management, personnel management, and information security technical requirements. Security policy developers: individuals who understand the organizational culture, policies, and requirements for developing and implementing successful policies. Risk assessment specialists: individuals who understand financial risk assessment techniques, the value of organizational assets, and the security methods to be used. Security professionals: dedicated, trained, and well-educated specialists in all aspects of information security from both technical and non-technical standpoints. Systems administrators: individuals with the primary responsibility for administering the systems that house the information used by the organization. End users: those the new system will most directly impact. Ideally, a selection of users from various departments, levels, and degrees of technical knowledge assist the team in focusing on the application of realistic controls applied in ways that do not disrupt the essential business activities they seek to safeguard. Confidentiality is the term used to prevent the disclosure of information to unauthorized individuals or systems. For example, a credit card transaction on the Internet requires the credit card number to be transmitted from the buyer to the merchant and from the merchant to a transaction processing network. The system attempts to enforce confidentiality by encrypting the card number during transmission, by limiting the places where it might appear (in databases, log files, backups, printed receipts, and so on), and by restricting access to the places where it is stored. If an unauthorized party obtains the card number in any way, a breach of confidentiality has occurred. Breaches of confidentiality take many forms. Permitting someone to look over your shoulder at your computer screen while you have confidential data displayed on it could be a breach of confidentiality. If a laptop computer containing sensitive information about a company's employees is stolen or sold, it

could result in a breach of confidentiality. Giving out confidential information over the telephone is a breach of confidentiality if the caller is not authorized to have the information. Confidentiality is necessary (but not sufficient) for maintaining the privacy of the people whose personal information a system holds Integrity: In information security, integrity means that data cannot be modified undetectably.This is not the same thing as referential integrity in databases, although it can be viewed as a special case of Consistency as understood in the classic ACID model of transaction processing. Integrity is violated when a message is actively modified in transit. Information security systems typically provide message integrity in addition to data confidentiality. Availability: For any information system to serve its purpose, the information must be available when it is needed. This means that the computing systems used to store and process the information, the security controls used to protect it, and the communication channels used to access it must be functioning correctly. High availability systems aim to remain available at all times, preventing service disruptions due to power outages, hardware failures, and system upgrades. Ensuring availability also involves preventing denial-of-service attacks. Authenticity: In computing, e-Business, and information security, it is necessary to ensure that the data, transactions, communications or documents (electronic or physical) are genuine. It is also important for authenticity to validate that both parties involved are who they claim they are. Non-repudiation: In law, non-repudiation implies one's intention to fulfill their obligations to a contract. It also implies that one party of a transaction cannot deny having received a transaction nor can the other party deny having sent a transaction. Electronic commerce uses technology such as digital signatures and public key encryption to establish authenticity and non-repudiation. Management generally involves the following activities or techniques Planning: Making informed decisions about what to do in future. Organizing : Making arrangement to fulfill the plan requirements Staffing: Employing the right people for the job. Leading: influencing the members of the organizations to move towards the common goal of the organization. Controlling: Making checks to find the deviations / holds ups and taking corrective actions/s.