Name: PptxGenJS Presentation
Uploaded: 2026-03-29
Duration: 6 min 4 s
Description: FUNDAMENTALS OF INFORMATION SYSTEMS SECURITY. Chapter 1: Overview of Risks, Threats, and Infrastructure.

FUNDAMENTALS OF INFORMATION SYSTEMS SECURITY. Chapter 1: Overview of Risks, Threats, and Infrastructure. 

Scene 1

FUNDAMENTALS OF INFORMATION SYSTEMS SECURITY

Chapter 1: Overview of Risks, Threats, and Infrastructure

THE DIGITAL FRONTIER: GROWTH OF THE INTERNET AND IOT. 

Scene 2

THE DIGITAL FRONTIER: GROWTH OF THE INTERNET AND IOT

The Internet has undergone a profound transformation since its inception, evolving from a specialized academic and governmental tool into a global infrastructure with over 3 billion users. This expansion has fundamentally altered how individuals communicate and how businesses operate.

Beyond traditional computers, an increasing variety of devices—including smart cars, home appliances, and industrial systems—are now interconnected. This interconnectedness expands the potential attack surface for cybercriminals and state-sponsored actors.

Modern life and business operations are now inseparable from cyberspace. This deep integration makes information security a critical necessity for maintaining privacy, economic stability, and national security in an always-on world.

Connectivity exposes systems to aggressive cybercriminals, terrorists, and state-sponsored attackers. These threats target sensitive data, intellectual property, and critical infrastructure, requiring a proactive and multi-layered defense strategy.

CORE CONCEPTS: RISK, THREAT, AND VULNERABILITY. CONCEPT. 

Scene 3

CORE CONCEPTS: RISK, THREAT, AND VULNERABILITY

The likelihood that a negative event will impact an asset.

Potential financial loss due to a data breach.

Malware, natural disasters, or unauthorized access.

A weakness that allows a threat to be realized.

Unpatched software or lack of user training.

A threat alone is often harmless; it requires a corresponding vulnerability to be exploited. Security professionals focus on minimizing vulnerabilities to reduce overall risk.

THE CIA TRIAD: THE THREE TENETS OF SECURITY. CONFIDENTIALITY. 

Scene 4

THE CIA TRIAD: THE THREE TENETS OF SECURITY

Ensures that sensitive information is accessible only to authorized users. It prevents unauthorized disclosure of private data, intellectual property, and national security secrets through encryption and access controls.

Focuses on the accuracy and validity of data. It ensures that information has not been altered or corrupted by unauthorized parties, maintaining the trustworthiness of the data throughout its lifecycle.

Guarantees that systems, applications, and data are accessible to authorized users whenever they are needed. This involves protecting against hardware failures, power outages, and denial-of-service attacks.

The C-I-A Triad serves as the foundational model for developing security policies. Every security control is designed to address one or more of these core properties.

LEGAL LANDSCAPE: KEY U.S. COMPLIANCE LAWS. LAW. INDUSTRY. 

Scene 5

LEGAL LANDSCAPE: KEY U.S. COMPLIANCE LAWS

Security controls for federal operations and assets.

Privacy and security of patient health information.

Integrity and reliability of financial reporting.

Protection of consumers' private financial data.

diagram Of the
by CIO to:
one from the above
2. the o o e
3. Write •page on
(Your summary must include the url that you identified in Step

Compliance with these laws is mandatory. These regulations drive the implementation of security controls across the seven domains of IT infrastructure to protect sensitive data.

THE SEVEN DOMAINS OF IT INFRASTRUCTURE. A HOLISTIC SECURITY VIEW. 

Scene 6

A typical IT infrastructure is organized into seven distinct domains. This modular approach allows security professionals to apply specific controls tailored to the unique risks and requirements of each area, creating a comprehensive defense strategy.

Security must be applied across all domains to create a "defense in depth" strategy. Each domain represents a potential point of entry; by securing them individually, organizations ensure that a breach in one area does not lead to a total system compromise.

USER & WORKSTATION DOMAINS: ADDRESSING THE WEAKEST LINK. 

Scene 7

USER & WORKSTATION DOMAINS: ADDRESSING THE WEAKEST LINK

The User Domain is widely considered the "weakest link" in any security infrastructure. Human error, social engineering, and a lack of security awareness often provide the easiest path for attackers to gain unauthorized access.

Mitigation strategies include mandatory security awareness training and the implementation of Acceptable Use Policies (AUP) to define behavioral expectations.

The Workstation Domain focuses on the security of end-user devices, such as PCs and laptops. Hardening these systems involves regular software patching, antivirus updates, and restricting administrative rights.

Strong authentication, including unique logon IDs and complex passwords, serves as the primary defense at this level to protect the entry point into the IT infrastructure.

NETWORK DOMAINS: LAN, LAN-TO-WAN, AND WAN. LAN DOMAIN. 

Scene 8

NETWORK DOMAINS: LAN, LAN-TO-WAN, AND WAN

Covers local connectivity including wires, fiber-optics, and Wi-Fi. Security is maintained through departmental segmentation and strict access controls to prevent internal lateral movement of threats.

The critical boundary where the internal network meets the public Internet. This domain is protected by stateful firewalls and Intrusion Detection/Prevention Systems (IDS/IPS) to filter malicious traffic.

The public Internet is inherently insecure as standard TCP/IP traffic is transmitted in cleartext. Cryptography and VPN tunnels are required to transform cleartext into ciphertext for end-to-end privacy.

REMOTE ACCESS & SYSTEM DOMAINS: SECURING ASSETS. REMOTE ACCESS DOMAIN. 

Scene 9

REMOTE ACCESS & SYSTEM DOMAINS: SECURING ASSETS

Essential for modern mobile workforces but introduces high risks. Secure remote access requires robust encryption, VPN tunnels, and multi-factor authentication to verify the identity of remote users.

Critical controls include secure browser software (HTTPS) and authentication servers to prevent unauthorized entry via the public Internet.

GUIDELINE
[provides recommended guidance)
PROCEDURE
(establishes proper Steps to take)
STANDARD
quantifiable requirementsl
CONTROL OBJECTIVE
lidentifies desired conditions to be met]
POLICY
I sets high-level expectationsl
FYI
How Do WE
ACTUALLY Do 'r?
WHAT Is OUR
WHArARE THE BEST PRACTICES?
WHY Do WE NEED To Do

The "treasure chest" of the organization, housing mission-critical applications and intellectual property. Protecting these assets involves physical security for data centers and server hardening.

Comprehensive Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP) ensure operations can survive and recover from major disruptions.

GUIDELINES
HOW
PROCEDURES
WHAT
STANDARDS
WHY

IT SECURITY POLICY FRAMEWORK: THE HIERARCHY OF CONTROL. 

Scene 10

IT SECURITY POLICY FRAMEWORK: THE HIERARCHY OF CONTROL

High-level statements from management defining the organization's security direction and course of action (e.g., "We will protect customer data").

Detailed requirements for hardware and software configurations to ensure consistency across the IT system (e.g., "All laptops must use AES-256 encryption").

Step-by-step instructions for implementing policies and standards, including installation, testing, and auditing (e.g., "How to install the VPN client").

Recommended but flexible actions that provide additional guidance to users for using policies, standards, or procedures.

This framework provides the necessary governance to manage risks and ensure compliance across the entire IT infrastructure by translating management goals into actionable instructions.

DATA CLASSIFICATION: CATEGORIZING FOR PROTECTION. 

Scene 11

DATA CLASSIFICATION: CATEGORIZING FOR PROTECTION

Data classification categorizes information based on its sensitivity and the impact of unauthorized disclosure. This allows organizations to allocate security resources effectively, applying the strongest controls to the most critical data.

PptxGenJS Presentation

Scene 1 (0s)

Scene 2 (9s)

Scene 3 (51s)

Scene 4 (1m 18s)

Scene 5 (1m 55s)

Scene 6 (2m 30s)

Scene 7 (3m 1s)

Scene 8 (3m 39s)

Scene 9 (4m 13s)

Scene 10 (4m 50s)

Scene 11 (5m 30s)