PREVNEXTSUBMITTable of ContentsResourcesGlossaryTranscriptClear and return to MenuSearch ResultsFilterSlide TextNotesSearch in:Check to includeSearch...TermsDefinitionFINISHfinishdefinitionresourcessearchpauseplayreplaysubmitnextpreviousvolumeSUBMIT ALLsubmit allQuestion ListMore infoSend an emailCloseBioExit introduction relevancebackgroundterms general procedures overview why study information security?demandbureau of labor studies (bls) estimates classified as 15-1122 relevance 80,000 information security analysts3,390 in the state of florida $50,000 $138,000 $90,000mean wage $90,000mean wage click here to learn more. click here to learn more. bls metrics international information systems security certification consortium – iisscc, (isc)2 13% 900,000 $78,000 2.28 million industry estimates: iisscc metrics why is the industry paying so many people so much money to maintain information security? what is driving the profession? demand drivers increasing criticality of information increasing criticality of information increasing quantity of information increasing quantity of information increasing computerization of information increasing computerization of information individuals: photographs, school workorganizations: payroll, intellectual property, business processes, etc. customer details, purchase history, clickstream etc. no more paper ledgers demand drivers critical information more copies of information available laptops (can be stolen) smartphones (can be broken) complexities more diverse population of users more diverse population of users more committed attackers more committed attackers motivated by profit motivated by profit less aware less aware not necessarily computer-savvy not necessarily computer-savvy demand drivers security professionals researching new technologiesinternal/political issuesmeeting regulatory compliancedeveloping internal security 49% 46% 45% 39% risk managementsecure sdlcforensicsend-user awarenesssecurity architectureaccess controlsecurityplanning competencies many current security procedures are the result of well-known past incidentspart of industry folkloreprofessional vocabularymore comprehensive list available from many sourcesonline (e.g. wikipedia)industry publications (e.g. informationweek, computer world) brief history 1981 tcp/ip finalized tcp/ip finalized no mention of security no mention of security internet community generally considered benign internet community generally considered benign brief history “hacker” “hacker” 19821983 gang of 414’s gang of 414’s computer fraud and abuse act 1986 computer fraud and abuse act 1986 brief history 1988 first conviction under 1986 act first conviction under 1986 act morris worm morris worm 10% of internet crashed 10% of internet crashed 99-line program 99-line program november 2nd november 2nd cert/cc established at cmu cert/cc established at cmu brief history 1995 windows 95august 24, 1995 windows 95august 24, 1995 almost no security almost no security windows 95 + tcp/ip windows 95 + tcp/ip windows 98june 25, 1998 windows 98june 25, 1998 fertile ground for security problems fertile ground for security problems no improvement in security no improvement in security brief history 1996 health insurance portability and accountability act health insurance portability and accountability act electronic health records electronic health records brief history 2000 “i love you” virusmay 5, 2000 “i love you” virusmay 5, 2000 deleted images on computers deleted images on computers $8 billion in damages $8 billion in damages college students in the philippines college students in the philippines traced immediately traced immediately no charges filed; not an offense no charges filed; not an offense brief history 2002 sarbanes-oxley act sarbanes-oxley act financial statements produced by it systems financial statements produced by it systems corporate fraud corporate fraud brief history 20052007 millions of credit cards stolen millions of credit cards stolen retail industry retail industry exploited it insecurities exploited it insecurities unencrypted wireless networks unencrypted wireless networks albert gonzalez albert gonzalez brief history 2008 massive denial of service attacks in georgia massive denial of service attacks in georgia government websites defaced government websites defaced war between russia and georgia war between russia and georgia russian involvement russian involvement first state-sponsored cyber warfare first state-sponsored cyber warfare brief history 2009 us electricity grid us electricity grid numerous incidents numerous incidents defend us military computer networks defend us military computer networks establish us cyber command establish us cyber command brief history 2010 traced to two educational institutions traced to two educational institutions operation aurora operation aurora congress announced to investigate congress announced to investigate google reports cyber-attacks from china google reports cyber-attacks from china brief history 2011 70 million subscribers 70 million subscribers network down for the summer network down for the summer difficult time difficult time credit card information stolen credit card information stolen sony playstationnetwork compromised sony playstationnetwork compromised brief history 2013 february february chinese army source of most cyber attacks chinese army source of most cyber attacks mandiant report released mandiant report released brief history information securityprotecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide integrity, confidentiality and availability. definition cia triad confidentiality integrity availability information security confidentialitypreserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information. definition confidentiality is the mechanism by which custodians of information maintain privacy of individual information.most common interpretation of information securitysocial expectations keep changing confidentiality integrityguarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. definition availability ensuring timely and reliable access to and use of information. definition top three recommendations:antivirus softwareautomatic software updatesat least two passwords personal information security february 2010wikileaks released classified memos from u.s. state department archives; which were published in leading newspapers of the world, such as the new york times.embarrassing to u.s. government and violated the trust of foreign leaders in u.s. government’s ability to keep secrets.pfc bradley manning was the source, who was one of 3 million u.s. personnel with access to the cables.part of u.s. government effort to leverage information to stop terrorist attacks. wikileaks: example overview of information securityprofessional relevancebrief historydefinition of information security summary you have reached the end of this presentation.<html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Hello and welcome to the class on Information Security and IT Risk Management. My name is Manish Agrawal and I will be the instructor for this class. </textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Okay so in this chapter we will essentially introduce information security as a topic of study in order to motivate you to get interested in studying information security. We will start with a look at the professional relevance of information security, including the professional demand, salaries, typical activities performed by information security professionals etc. Having established that studying information security is worth your time, we will take a quick sweep of the history of this admittedly recent topic. We will talk about how issues of information security have come to the limelight, and the key incidents that have brought information security to the mainstream. People these days have very short memories, but I believe all IT professionals should be aware of these incidents and their implications. After this quick history, we will define information security and the components that constitute the definition of information security. Before we wrap up the chapter, as a take-away gift for you, I have the most important recommendations for personal information security from my perspective.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>As a business school professor, I firmly believe that everything I do in class needs to be directly related to meeting some definite professional workforce needs. Information security falls into one of those very important professional workforce needs. In this picture, I have tried to indicate how the US government views information security within the overall framework of all occupations in the United States. This information is maintained by the Bureau of Labor Studies, which is the US government organization that collects employment statistics around the country using the most robust survey methods possible. This information helps policymakers and educational institutions allocate resources and determine courses to be taught. Information security analysts fall under the category 151122, which is a subgroup of computer and information analysts, which in turn is a part of 15, which is computer and mathematical operations. Occupations have to have broad relevance before the BLS tracks them, so you can see that information security is now a broad enough professional area of work for the Bureau of Labor statistically to formally keep track of this profession. What this means to you is that if current trends continue, and you have the right set of skills, the industry should be large enough to absorb you when you graduate from our program.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>In this slide, I have tried to collect some salient metrics from the Bureau of Labor Statistics. As of May 2013, the Bureau of Labor Studies estimates that there were about 80,000 people working as information security analysts, including 3,390 in the state of Florida. The mean wage is estimated to be slightly over $90,000 which I think would be considered a very satisfactory salary by most metrics. I would highly encourage everyone to go to this URL to get the current information and to check out some of the other details that the BLS has put out. For example the BLS has information about the breakdowns by Metro area and salary distributions by state, by industry and by metro area.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Now apart from the government, the industry also tries to make similar estimates. These efforts are led by an organization called ISC Squared, which stands for the International Information Systems Security Certification Consortium. Incidentally, this organization is located very near us in Clearwater, Florida. According to ISC Squared, there are about 900,000 information security professionals in North and South America and over 2 million professionals working in information security worldwide. ISC Squared has estimated the median wage at about $80,000 and the growth rate at about 13%. You might wonder about the significant divergence between the workforce estimates of the BLS and ISC-Squared. This happens because the BLS tries to be very precise in its methods, whereas ISC Squared takes a broader view of information security professionals. For example, most people working on computer networks would have an information security role and ISC Squared would include them in the information security workforce, whereas BLS would put them in another category. Either way, from my perspective these numbers indicate that information security is a fairly important profession.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>So why is the industry paying so many people so much money to maintain information security? What is driving the profession? </textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>In my view it begins with the fact that more and more of our information are being computerized. Further, the information itself is becoming increasingly critical to businesses and individuals. If you don't believe me, take away a computer network or computer or Smartphone from anyone and see how uncomfortable and irritable they get within just 5 min. of being disconnected. So we are now personally, extremely dependent upon information. Organizationally too, we are becoming more and more computer-based and paper-less, depending upon computers to track information, automatically run business processes, communicate and so on. Information security professionals are involved in making sure that this information is available when needed, is correct when we act on it and so on. </textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Next, not only is information becoming more critical, we are also getting more and more of this critical information as time goes by. A decade ago, we never recorded as much information about people's behavior as we do today. Almost every retailer now tracks every interaction with every customer and increasingly, to actually act on this historical information. Information security professionals make sure that the information that is used to make decisions is secure.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>We continue with our demand drivers. We have seen that we have more information, and the information that we have is more and more critical. Let's add some complexities to this environment. Since information is rather cheap to copy and store these days, we have more copies of the same information. I'm sure every single one of you has multiple copies of your work files, some on your laptop, some on your home computer and some on smart phones and other devices. This means that there are more ways that things can go wrong - laptops can be stolen the smart phones can be dropped. </textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Further, as computers become more mainstream, we have a lot of users who just see them as a workplace tool, with no idea about the underlying complexities of the tool. So we have a lot of critical information, on a lot of devices, being used by a lot of not so knowledgeable people. So a lot of things can go wrong. And this creates a fertile environment for attackers to exploit the situation. If users have their bank account information on multiple computers, all a hacker needs to do is get access to one of these devices and use information from the device to steal some money from your bank accounts. Information security professionals try to prevent these adverse outcomes from materializing.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>All right, getting closer to the work of information security professionals, according to the Bureau of Labor Studies they do a lot of technical work. They ensure that appropriate security controls are in place and manage the IT infrastructure. They also do a lot of non-technical work, including researching new technologies to identify any possible information security implications. They try to anticipate political issues arising from new IT infrastructure because these often create subtle power shifts, which can affect how the technology is used. They ensure that the organization is compliant with any regulatory requirements. They also spend a lot of time formalizing these expectations as internal policies.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Continuing from the previous slide, here is an estimate by ISC Squared about how information security professionals typically spend their time. As you can see, the bulk of their time is spent researching new technologies and dealing with political issues associated with the deployment of new technologies. They also spend a lot of time on regulatory compliance and developing internal policies.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Related to the above, here are the desired competencies for information security professionals, as identified by ISC Squared. You can see that the desired competencies span the entire spectrum of IT activities. They need to identify and deal with risks. With regards to software development, information security professionals need to be aware of secure software development practices. To deal with problems, information security professionals need to be able to perform forensics to detect what happened. They need to be able to architect the IT infrastructure so that it is resilient to attacks in the first place. They need to be ready to respond to large scale events.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>I strongly believe that professionals should have at least a passing awareness of the background of that domain. Many current practices are in place because of the unique ways in which the industry has evolved. Here is a brief overview of some of the most important information security incidents. The list is not complete, but virtually every incident considered here has had a lasting impact on information security that we experience even today. </textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>We start with the early 80s, when the primary networking technologies of TCP and IP was finalized. These underlying networking technologies make no mention of information security. Partly this is because the Internet community at that time was thrilled that they could even get a rudimentary Internet to work. Also, at that it was difficult to anticipate all the different ways in which things could go wrong on the Internet. And finally, many of the architects of the Internet had a very strong independent streak. They wanted to leave any security concerns to the end-user, and not let Internet service providers dictate information security terms to end users. One unfortunate result of this approach has been that the Internet remains vulnerable to information security issues. But on the other hand, this openness has led to the Internet enjoying great popularity even within totalitarian countries. Had the Internet not been so open, it is distinctly possible that many dictatorial governments would have denied Internet coverage within their countries in the name of security.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Information security incidents began pretty much as soon as the Internet became available. In the summer of 1982-83, six teenagers in Milwaukee were getting bored in the summer. One of these teenagers had access to a computer and they figure they might try to do something interesting with this computer. So what they did was they followed instructions in magazines to hook up the computers to a phone line and they thought it would be interesting and fun to see what computers they could connect to. At that time the computers in various high-security establishments were all new and the system administrators of these computers were not very well aware of how they needed to secure their computers. So these teenagers were able to access about 60 of these very high profile computer systems, including the one at the Los Alamos National Laboratory. Now this was obviously scary to a lot of people because it showed how our infrastructure was vulnerable. These kids became famous as the gang of 414's, named after the area code around the Milwaukee area. When the incident became famous especially after a Newsweek cover story, the U.S. Congress held hearings on computer security and this led to the passing of the computer fraud and abuse act of 1986.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>The computer fraud and abuse act was invoked pretty soon after it was passed and this was in connection with the Morris worm. The worm is named after Prof. Robert Morris Junior, who was then a graduate student at Cornell, and is now a professor at MIT. He wanted to measure the size of the Internet at that time. So he wrote a program that was about 100 lines long, and the idea behind this program was that it would go to a machine send a ping back to the home computer, replicate itself and get itself installed on to the next neighboring computer and so on. So, it was supposed to be a research project. The problem is that there was a little bug in the program, which caused the computers on which this program was installed to crash. Now we have had a lot of computer worms since then, but the Morris worm is famous because it is estimated that about 10% of the machines on the Internet at that time were affected by the Morris worm and essentially crashed. Which means that the Morris worm succeeded in crashing about 10% of the Internet? Prof. Morris was convicted under the 1986 computer fraud and abuse act. In addition, the CERT center was established at CMU as a result of this incident because the US government wanted to be able to monitor computer security issues nationwide.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>In 1995. Microsoft released Windows 95, accompanied by an extensive marketing campaign. Many people bought Windows 95 computers as some sort of toys for grown-ups. This hugely expanded access to computers nationwide with people buying computers without even figuring out what they would do with it. When Windows 95 was designed, the Internet wasn't especially popular nationwide, so Windows 95 had no information security protections such as user accounts, access control, etc. But as soon as people bought Windows 95 computers, the next thing they wanted to do was to use it to send out e-mails to friends and family. This meant that they wanted to connect these computers to the Internet. So we had an environment where computers running an insecure Windows 95 operating system were connected to each other over an Internet running insecure TCP/IP. This environment had a huge role to play in making information security a household problem.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>In 1996, Congress passed the HIPAA act, the health insurance portability and accountability act. A big part of this act was about people being able to take their health insurance information from one physician office to another. But another part of the act was about electronic health records and a requirement for healthcare professionals to ensure the confidentiality of patient information. There is a big push to make electronic health records mandatory for a physician's office to be able to accept Medicare patients, and this is driving up demand for information security professionals nationwide.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>The insecure Windows 95 over insecure TCP/IP environment resulted in one of the most famous computer viruses in May 2000. This virus was called the "I love you" virus because of the subject line of e-mails received from people affected by this virus. Basically if your computer was infected, this virus would read through your contact list and send itself as an email attachment to all the friends in your contact list. If any one of your friends opens the e-mail, they would themselves get infected and the virus would then proceed to send itself to all his friends. The "I love you" virus caused extensive damage worldwide. The estimated cost of cleaning up the virus worldwide was about $8 billion. The interesting thing about the "I love you" virus is how it exposed international differences in information security laws. It turned out that the virus was created by two college students in the Philippines. It did not take long for the FBI to figure out the source of the virus. However, in 2000 there was no law in the Philippines that made writing a virus a criminal offense. And so the end result was that the creators of the "I love you" virus went scot-free even though the United States did everything in its capacity to get the creators of the virus convicted. You'll find that legal differences over information security issues continue to exist today and in all likelihood will continue to exist in the future.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Most of the developments in information security that we have seen so far have affected individuals and personal computers. But in 2002, Information security went corporate. What happened was that in the late 1990s, when the stock market was booming, a lot of corporate executives were able to exploit weaknesses in their computer systems to record fraudulent transactions. They did this because they wanted to manipulate the stock prices of their companies and since stock prices depend upon sales numbers and profit numbers, these executives would just go in and manipulate and record fraudulent sales to boost the profits. When this came to light, Congress passed the Sarbanes-Oxley act, which made it a crime for CEOs and CFOs to report incorrect financial statements, no matter how the incorrectness happened. The result was that all publicly traded companies are now required to follow specified information security procedures to ensure that the financial statements reported by these companies are correct. In fact, it may not be an exaggeration to say that classes such as this would not have been created were it not for the Sarbanes-Oxley act which required a whole swath of companies to follow certain specific information security procedures. The Sarbanes-Oxley act in many ways created a large-scale information security industry in the United States.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>If the Sarbanes-Oxley act of 2002 took information security into the corporate boardrooms of publicly traded companies, an interesting incident at T.J. Maxx took information security into every business, small or large. What happened at T.J. Maxx is really a textbook example of all the ways in which a company can do its information security wrong. T.J. Maxx did not use wireless encryption at its stores. So, Albert Gonzalez, an information security expert, figured out that he could just stand outside the stores early in the morning when the stores opened and could skim off passwords floating in the air over the wireless network when store employees logged into the systems. What is even more interesting is that the same passwords and usernames gave Albert access into the IT systems at corporate headquarters of T.J. Maxx. Using this information Albert and his associates stole about 45 million credit cards from T.J. Maxx. These cards were then sold off to buyers. The T.J. Maxx incident made every company in the United States take wireless security seriously and motivated credit card companies to impose security requirements on wireless networks.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>In 2008 Russia attacked Georgia. Wars have occurred throughout history, so there was nothing special about the war as such. However, what's interesting about this war from our perspective is that it is considered the first incident of state-sponsored cyber warfare. As the war was going on, many government websites in Georgia were defaced and many bank networks were disabled. It is strongly suspected that the state apparatus of Russia was involved in these cyber attacks. Since this time, countries have become aware of the distinct possibility of militaries using computer networks as a mechanism of war.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>In 2009, the United States established its cyber command. The role of the US cyber command was to defend all US military computer networks, as well as to do what was necessary to protect America's interests on the Internet. The establishment of the cyber command was motivated by a number of incidents, including theft of data from one of the largest projects undertaken by the US military. It was also suspected that the US electricity grid had been compromised and enemy countries could cause outage at will. The US cyber command is charged with preventing the occurrence of such incidents in the future.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>In 2010, Google reported cyber-attacks designed to steal its intellectual property originating from China. Google also traced the attacks to two educational institutions in China. This attack attracted a fair amount of publicity because it showed that state actors could now potentially target companies. Until now, companies were concerned about intellectual property theft from competitors. A Cyber attack from state actors is a bigger challenge because state actors typically have larger budgets than corporate actors. So the Google China incident reveals that matters related to cyber security has now escalated and skill requirements to successfully defend against attacks have notched up. Incidents such as this have promoted interest in courses and degree programs in cyber security. IMG SOURCE: http://its.ucsc.edu/google/images/google-securityicon.png</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>An incident that was personally important to me was the Sony PlayStation network compromise of 2011. It happened right at the start of summer and disabled the PlayStation network virtually that entire summer. Unfortunately, the PlayStation network was at the center of my son's plans for that summer. After a hard year's work, he had been looking forward to spend a month or two that summer on the PS3. But the very last minute, he had to scramble up new summer plans because of this compromise.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>In 2013, the company Mandiant, released a report which identified a specific unit of the Chinese army as the source of most cyber attacks on US entities in recent years. The depth of detail in the report makes it very interesting to read. The report removed any doubts that state-sponsored industrial espionage was now a central part of the information security problem globally.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>To prepare for the rest of the class, we will now define information security. The examples we saw so far give us a general sense of the information security problem. But formally, information security is defined as maintaining the integrity, confidentiality and availability of information. The more formal definition is on the slide and it comes from the United States code section 3542. What I like about this definition of information security is that it is consistent across the industry. For example, if you look at RFC 2196, which is released by the Internet Engineering Task Force (IETF), it too defines information security as providing integrity, confidentiality and availability of information. As long as you are involved with the information security profession, you are going to be concerned with protecting the integrity, confidentiality and availability of information.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>As a pneumonic tool, people like to rearrange the order of the components of information security, and write it as confidentiality, integrity and availability. When written this way, information security is known as the CIA triad, making it easier to remember. </textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Let's start with confidentiality. Confidentiality is the responsibility of an organization to maintain the privacy of information in its custody. This means that individuals should be allowed to read protected information only if they are authorized to read it. The responsibility of confidentiality comes about because we recognize the individual right to privacy. </textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Confidentiality is what lay people typically understand as information security. People understand intuitively that when they share their credit card information with a restaurant or online retailer, that information should be should not be leaked. But, confidentiality is a very challenging aspect of information security. Of all the three components of information security, confidentiality requirements are the most difficult to define. Society evolves and with it, social expectations of privacy change. As an information security professional, you need to be aware of this dynamic. </textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Integrity refers to the correctness of information. It means that organizations must make sure that information cannot be improperly changed. For example, once a grade has been assigned to you in a class, it should not be possible for an instructor or other administrator on campus to be able to change your grade. Alternately, when an employer receives your transcript, they need an assurance that the transcript accurately refers to the grades you have earned, and that the grades shown on a transcript are not unauthorizedly inflated. </textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>Availability refers to the idea that information must be available when it is needed. It is the idea that if you try to access a website, it will be in a position to take your orders and will not be crushed by an onslaught of unexpected orders.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>That completes our formal introduction to information security in this chapter. Before we wrap up, here is a little gift in the form of my recommendations about the top three things you can do to maintain your own personal information security. The first and foremost thing you can do is to install antivirus software. In this book we refer to this software as end-point protection software because modern antivirus software does a lot more than just check for viruses. Endpoint protection also looks for malware, unauthorized logins, etc. The second you can do is to enable automatic software updates. We will have more to say about updates later in the class. But for all personal machines, it is a good idea to allow vendors to automatically update software. This helps remove vulnerabilities as they are patched. Finally the third thing you can do is to distinguish between financial and nonfinancial accounts when it comes to passwords. In a perfect world, you would have a separate password for every website. In the practical world, if you wish to economize on passwords, please at the very least; do not use passwords that you use on financial institutions elsewhere. The idea is that you may assume that banks have the incentives to take extra precautions to protect your passwords, but other sites may be lacking such incentives to protect passwords. Therefore, you should assume that passwords from non-financial institutions will be stolen and should plan your affairs such that your financial accounts are safe even in these conditions.</textformat></html><html><textformat leading='1' tabstops='[48, 96]' leftmargin='0' indent='0'>One of the things we have tried to do in our textbook is to introduce one example from industry that relates to the issues covered in the chapter and ask you to do some Internet research related to this issue. For this chapter that example is Wikileaks. </textformat></html>