Information Security Management Fundamentals for Non-Techies

Explore the eight high-level domains of information security, including risk management, asset security, security architecture, network security, identity and access management, security assessment, security operations, and software development security.

Examine how 2024 escalates cyber risk with record breach costs, ransomware and phishing growth, AI-driven threats, and multi-cloud security challenges, while highlighting workforce shortages and long breach detection timelines.

Explore ten cybersecurity specialties and a salary pay band, and learn how each role protects networks, systems, and cloud environments.

Identify the most valuable beginner IT security certifications, including Security+ and CEH, plus entry-level options like SSCP, CC, and eJPT, and essential IT and cloud certification tracks.

Explore fundamental information security principles that lay the framework for this course, including the CIA triad, AAA, lease privilege, legal and regulatory compliance, and authentication.

Discover the CIA triad of confidentiality, integrity, and availability, with encryption and backups. Learn the DAD triad, disclosure, alteration, destruction, and how risk-based tradeoffs protect it and business operations.

Explore the Parkerian Hexad, an expanded security model to the CIA triad, adding possession, authenticity, and utility, with risk-based decisions and real-world data security examples.

Learn how authentication, authorization, and accounting form the AAA security framework, enforcing access control policies and auditing user and system actions to protect data integrity and mitigate risks.

Defense in depth layers security across policies, procedures, physical security, and perimeter defenses like firewalls and DMZ to protect the protected network, using a castle moat and drawbridge analogy.

Apply the least privilege principle by granting users, systems, and applications only the permissions necessary to perform their tasks, using security groups for top secret, secret, and unclassified data.

Discover how non-repudiation prevents denial of actions by using digital signatures, certificates, and audited logs across documents, emails, and system access.

Apply implicit deny using access control lists to block all traffic not explicitly allowed, exemplified by permitting only port 443 https to a public web server.

Assess how to stay compliant with information security laws and standards, including FISMA, HIPAA, GLBA, and PCI-DSS. Understand due care and due diligence and how neglect can yield legal liability.

Drive information security governance with a governance office and senior leadership to craft high-level policies guiding security, balancing cost, risk, and compliance for business alignment.

Explore authentication basics and the three factors: something you know, something you have, and something you are, using passwords, smart cards, tokens, biometrics, and two-factor authentication as examples.

Learn how identity proofing validates who you are before issuing credentials, distinct from authentication. Explore like driver's licenses, social security numbers, and security questions for account setup and password recovery.

Strengthen passwords with at least 12 characters, mixed case, numbers, and symbols, avoid guessable info, reuse, or default credentials, and enable multi-factor authentication; future lessons cover password managers and passphrases.

Secure passwords with password managers that encrypt them and generate strong passwords. Use passphrases like elephant cake rainbow dancing, easier to remember and cryptographically stronger than complex passwords.

Explore the fundamentals of risk management in information security, covering threats, vulnerabilities, and exploits, and compare quantitative and qualitative risk assessments with practical examples.

Define risk as an uncertain future event, distinguish between risks and issues, and explain the risk equation risk equals threat times vulnerability in IT security.

Define what an issue is as a realized risk and illustrate how a failed service desk software renewal becomes an issue that causes IT ticket delays and manual triage.

Identify assets, threats, vulnerabilities, and the risk equation: risk equals threat times vulnerability. Learn to assess, prioritize, and respond with avoidance, mitigation, transfer, or acceptance, while tracking residual risk.

Identify and classify IT assets, assess threats and vulnerabilities, and conduct risk assessments to determine responses such as accept, mitigate, transfer, or avoid, acknowledging residual risk.

Every level of an organization uses risk management, from projects and programs to business units and the organization itself. Implement enterprise risk management across the entire organization.

Explore how risk appetite and risk tolerance, defined by ISO 31000, guide risk management, with cloud computing examples, residual risk, and executive decisions for opportunities.

Explore different risk and threat types in information security, including monetary costs, asset losses, reputation, and legal risk, and categorize threats as natural, unintentional, or intentional.

Identify common risk categories in IT risk management, including budgetary, information security, operational, organizational, regulatory (GDPR), resource, schedule, strategic, supply chain, and catchall technology risks.

Identify IT risks through IT security assessments and business analysis, using vulnerability assessments, penetration tests, and audits, plus SWOT analyses and business impact analysis across all stakeholders.

Explore quantitative risk analysis by defining asset value, exposure factor, SLE, ARO, and ALE, and apply a data-center earthquake example to compare ALE with insurance costs.

Explore attack surface analysis across applications, networks, and users to identify vulnerabilities, including code flaws, data input, ports, and configurations, and learn how policies, training, and least privilege reduce risk.

Explore asset management basics, including asset life cycle and data retention, to identify, classify, and protect an organization's hardware, software, data, intellectual property rights, and employees.

Identify and inventory assets, apply asset identification and classification, assign ownership, and classify by value to guide protection and resource allocation; regularly review assets as their value and classification change.

Explore the asset lifecycle from identification and classification to protection, monitoring, recovery, and disposal, including archiving and defensible destruction to prevent data remnants.

Retain data for the long term only when required by legal, regulatory, or organizational needs, and implement strong records retention policies to protect sensitive information from breaches.

Examine data states: data at rest, data in motion, and data in use; encryption guards rest and motion, while data in use relies on access controls, integrity checks, and auditing.

Explore access control concepts to protect assets by combining logical and physical measures, learn how they differ, and gain insight into logical access control models for defense in depth.

Master the six access control types—preventive, detective, corrective, recovery, deterrent, and compensating—and distinguish physical from logical access to protect assets and support the CIA triad.

Explore physical and logical access controls, including hardware locks, door access systems, ID badges, logs, ACLs, and password policies to strengthen security and auditing.

Explore three common access control models—mandatory, discretionary, and role-based—and how subjects and objects, with sensitivity labels, determine permissions across governmental, home, and business contexts.

Compare attribute-based access control with role-based access control. Attribute-based access control uses multiple attributes—time, location, device, and policies—to decide access dynamically, providing granular security for zero trust and cloud.

Explore modern authentication methods beyond usernames and passwords, including biometrics, passwordless options, adaptive authentication, and qr code login, with attention to security benefits and risks.

Identify and manage privileged access, implement discovery and credential management, enforce least-privilege and just-in-time access, and monitor sessions for security and regulatory compliance.

Analyze your organization's access control policies, including physical and logical controls and defense in depth, and reflect on potential security improvements from an IT security perspective.

Explore the role of IT auditing, its benefits and risks with case studies, outline the process, steps, and deliverables, and participate in a hands-on student activity.

Learn what an IT audit is as a formal evaluation of an organization's IT systems, policies, operations, and controls, including preventive, detective, and corrective measures and internal or external audits.

Conduct IT audits to ensure IT systems, governance, and internal controls comply with laws, regulations, contracts, and industry standards while protecting confidentiality, integrity, and availability and supporting business objectives.

Explore how IT audits ensure compliance with laws and regulations and validate efficient business operations. Gain measurable assurance of protection for IT assets for internal and external stakeholders.

Not performing IT audits risks non-compliance with regulations and weak disaster recovery and business continuity plans. Vulnerabilities go unaddressed, increasing cyber attack and data breach risk.

Identify the three high level IT audit phases—planning, field work and documentation, and reporting—and explain how scope, objectives, audit programs, testing, interviews, and corrective actions shape outcomes.

Define high level audit objectives and specific, measurable control objectives to assess internal information technology controls, minimize risks, and verify identity and access management with roles and permissions.

Auditors gather evidence through walkthroughs, interviews, questionnaires, and document reviews to assess information technology controls and the organization's security posture, ensuring the evidence is competent and sufficient for final report.

Documenting and reporting formalizes audit records, demonstrates compliance with auditing standards through evidence, and delivers a final report to stakeholders about the organization's security posture with recommendations and follow up.

Explore five major IT audit frameworks, including ISO 27001, NIST SP 800-53, PCI DSS, COBIT, and SOC, and how they guide governance, risk management, and certification.

Conduct a hands-on audit of your home network's security posture using a 12-item table, evaluating risk levels and items like passwords, multi-factor authentication, and administrator accounts, then generate corrective actions.

Explore how compliance, laws, and regulations shape IT security across industries, with examples of standards and geographic requirements from the United States, Canada, and the EU.

Explore how compliance means adhering to laws and industry standards like PCIDSS, how audits verify compliance, and the risks of noncompliance, including GDPR cases.

Apply layered security controls, including primary and compensating measures, to achieve and maintain compliance. Monitor, review, document, and report control performance to stay aligned with evolving risk management goals.

Clarify how standards, laws, and regulations differ and guide ongoing compliance, with examples like FISMA, GDPR, HIPAA, SOX, ISO 27000, and the NIST Cybersecurity Framework.

Explore malware basics, defined as software with malicious intent. Learn about viruses, worms, trojan horses, logic bombs, ransomware, and other common threats.

Buffer overflows occur when a program writes beyond a fixed memory buffer, enabling malware to be introduced. Defend with data input validation, runtime protections, and secure development practices.

Viruses are malware that infect, replicate, and deliver payloads such as spyware or data theft. Polymorphic viruses mutate and self-encrypt to evade anti-malware detection.

Explore worms, a self-replicating malware that spreads across networks without user interaction, consuming bandwidth and system resources and causing performance degradation or network outages.

Discover how Trojan horses conceal malicious intent inside something desirable, from the Trojan War tale to modern popups and free software that install malware such as spyware or viruses.

Explain how a logic bomb triggers on a specific event, activating embedded malware such as trojan horses, worms, or viruses. The Stuxnet example illustrates infected USBs and propagation.

Explore spyware and adware, how they install without consent, what data they collect (keystrokes, screenshots, credentials, PII, form data, marketing data), and how they differ.

Understand ransomware as malware that encrypts files and demands cryptocurrency payments for a decryption key, with WannaCry 2017 and Acer 2021 illustrating infection vectors.

Explore how rootkits, a severe malware type, gain root access and persist by modifying core system files to evade detection. See how they enable long-term espionage and data theft.

Explore zero day attacks that exploit unknown software or operating system vulnerabilities before patches exist, risking user harm; understand how bug bounty programs empower white hat researchers to report flaws.

Explore how mobile malware targets smartphones and tablets, including trojan horses, spyware, and ransomware, spread via unofficial stores and phishing links.

Identify cryptojacking, malware that mines cryptocurrency on a device, slowing it by using CPU and GPU power, and learn to detect phishing-driven or hidden mining scripts.

Learn how fileless malware operates entirely in memory after a file-based initial payload, using trusted tools like PowerShell and WMI to evade antivirus.

Learn how AI enhances malware to evade detection, adapt to security measures, and personalize attacks, with case examples like DeepLocker and polymorphic viruses, plus pros and cons.

Keep OS and apps up to date, use a non-admin account, and install trusted anti-malware software. Avoid opening suspicious attachments or links, ignore popups, and download apps from official stores.

Explore additional threats and vulnerabilities beyond malware, including social engineering, phishing, farming, and protocols booting. Learn common attack methods used to exploit networks and systems and how to protect them.

The lecture outlines common social engineering categories such as conning and flattery, impersonation, phishing, piggybacking, and dumpster diving, and offers practical defenses like training, skepticism, identity verification, and secure handling of documents.

Explore social engineering through phone impersonation skits, where the presenter impersonates someone to obtain PII information from his wife. Hear two successful calls and one failure, then join a discussion.

Explore how social engineering phone calls impersonate a fraud department to extract personal data, as a caller guides Sarah to reveal address and SSN to cancel and reissue a card.

Illustrates a social engineering phone call where an IT impersonator prompts a user to reveal a username and password to reset a QuickBooks account and set a new password.

Highlight a social engineering phone call impersonation where an attacker claiming to be IT pressures a user to reset a QuickBooks account, illustrating red flags and verification steps.

Explore social engineering over the phone, including fraud department and IT support impersonations to obtain personal data (PII) and passwords, plus practical verification steps.

Explore spam email, spoofed emails, phishing, and pharming, and learn how attackers forge headers and use malicious links to steal information or spread malware.

Explore modern phishing techniques, including spear phishing, whaling, BEC, quishing, vishing, smishing, and AI enhanced phishing, with real examples and prevention insights.

Identify insider threats as malicious insiders, negligent insiders, or third party risks, with examples like Tesla, Marriott, and SolarWinds to show how access to data creates risk.

Explore protocol spoofing and three common attack types: ARP spoofing, DNS spoofing, and IP address spoofing, and their impact on network security.

Learn common attack methods, including DoS and DDoS, back door, replay attacks, weak encryption keys, software vulnerabilities, remote code execution, SQL injection, and cross-site scripting (XSS).

Ransomware as a service describes a business model where operators develop ransomware and affiliates carry out attacks, sharing profits from encrypted files and crypto ransoms.

Explore advanced persistent threats (APTs) as nation-state or group attacks aiming at espionage, data theft, or sabotage, with examples like APT28 Fancy Bear, APT29 Cozy Bear, and Lazarus Group.

Explore how AI-enabled threats transform social engineering, deepfake fraud, AI-enhanced malware, AI-driven ransomware, model manipulation, and synthetic identities, with real-world examples and business impacts.

Explore how software supply chains create IT security risks—from third-party vendors and compromised updates to cascading SolarWinds-style attacks—expanding the attack surface across organizations.