Security Management: Systems, Tools, and Applications

UPI Study › Courses › System Analysis and Design › Free lessons › Lesson 8.3 Free with a free account

Security Management: Systems, Tools, and Applications

System Analysis and Design · Chapter 8: Maintenance, Risk, and SecuritySection 8.3 · lesson 55 of 697 min · free with a free account

← Understanding Risk: Insurable vs. Uninsurable CategoriesNext lesson: Types of Information Security Protocols →

Earn 3 college credits for System Analysis and DesignRecommended for credit by NCCRS · Computer Science 390 · self-paced · one payment, lifetime access
Enroll in System Analysis and Design · $250 →Download the syllabus (PDF)

In this lesson

The CIA triad, ISMS and ISO 27001, policies, the secure SDLC, and security tools.

  • Define the CIA triad, and why all 3 properties matter together
  • Describe an ISMS, and how ISO 27001 relates to it
  • Explain the role of security policies
  • Describe the secure SDLC, and 3 categories of security tools

Transcript

Everything said in the video, section by section (939 words). Read along, or search it.

Maintenance, Risk, and Security

Security Management

Security is not a feature bolted on at the end. It is something an organization manages, continuously. This section covers the three properties security protects, the management system and standard behind it, and the policies that set its rules. Then how security is built into the life cycle, and three categories of tools that support it every day.

Figure 8.1

The CIA Triad

The C I A triad names the three properties that information security is built to protect. Confidentiality means only the authorized can see information. Integrity means information stays accurate, and unaltered. Availability means systems and information are there when authorized users need them. The three are interdependent. A system can be strong on one, and still fail badly on another.

The 3 Properties

What Each One Protects

Here is each property, with an example of how it fails. Confidentiality means information is accessible only to those authorized to see it. A data breach exposing customer records is a confidentiality failure. Integrity means information is accurate, and has not been improperly altered. An attacker tampering with financial records, undetected, is an integrity failure. Availability means authorized users can reach systems and information when needed. A denial-of-service attack that takes a website offline is an availability failure. A serious security failure is usually a failure of exactly one of the three. Naming which one tells you what was actually lost.

ISMS and ISO 27001

Managing Security as an Ongoing System

An information security management system, or I S M S, is an organization-wide system of policies, procedures, and controls. It manages information security risk on an ongoing basis, rather than as a one-time project. I S O twenty-seven thousand one is the internationally recognized standard for an I S M S. It specifies the requirements for establishing, implementing, maintaining, and continually improving one. And organizations can be formally certified against it. An I S M S runs on a continuous improvement cycle called plan, do, check, act. Plan the controls, implement them, check how effective they are, and act on what is learned. So the difference is this. The I S M S is the organization's own system. I S O twenty-seven thousand one is the standard that system is measured against.

Security Policies

The Foundation Controls Implement

Security policies are formal, documented statements of an organization's rules and expectations around information security. A policy is not a technical control. It does not enforce anything by itself. It is the foundation, telling the I S M S's procedures and controls what they are supposed to achieve. An acceptable use policy sets what employees may and may not do with organizational systems and data. An access control policy sets who may access which systems or data, and under what conditions. A password policy sets rules for creating, storing, and rotating credentials. An incident response policy sets what happens when a security incident is detected, and who is responsible for what. And a data classification policy sets how data is categorized by sensitivity, and how each category must be handled.

The Secure SDLC

Security in Every Phase, Not Just at the End

The secure S D L C builds security into every phase of the life cycle, rather than testing for it only once, at the end. In planning, security and compliance requirements, and the organization's risk tolerance, are identified early. In analysis, explicit security requirements are documented alongside the functional ones. In design, the team does threat modeling, and designs controls into the architecture. In implementation, developers follow secure coding practices, and use static analysis to find vulnerabilities. In testing, security-specific tests, such as penetration testing, run in addition to functional testing. And in maintenance, the work continues, with ongoing patching, monitoring, and vulnerability management. Notice that static analysis appears again. The same scan that checks code against a coding standard, can also be set to flag known kinds of vulnerability.

Security Tools

SIEM, IAM, and Vulnerability Scanners

Three broad categories of tools support an I S M S day to day. A security information and event management tool, or S I E M, collects and correlates event and log data in real time, and alerts on suspicious activity. It might detect an unusual pattern of failed logins across several servers. Identity and access management, or I A M, manages who has access to which systems, enforcing authentication and authorization. It is the tool that ensures a former employee's access is revoked the moment they leave. And a vulnerability scanner automatically scans systems, networks, or code for known vulnerabilities and misconfigurations. It finds an unpatched software version, before an attacker does.

Key Terms

The Vocabulary of This Section

Let's lock in the key terms. The C I A triad is confidentiality, integrity, and availability. An I S M S is an ongoing, organization-wide system for managing information security risk. I S O twenty-seven thousand one is the international standard an I S M S can be certified against. A security policy is a documented set of rules that the I S M S's controls implement. The secure S D L C builds security activities into every phase of the life cycle. A S I E M tool detects suspicious events. An I A M tool controls who has access.

Key Takeaways

What to Carry Forward

To pull this together. The C I A triad names confidentiality, integrity, and availability. A serious security failure is usually a failure of exactly one of the three. An I S M S manages information security risk on an ongoing basis, and I S O twenty-seven thousand one is the standard it can be certified against. Security policies are the documented foundation that tells the I S M S's controls what to achieve. The secure S D L C builds security into every phase, from planning through maintenance. And S I E M, I A M, and vulnerability scanners are three distinct categories of tools, each supporting a different part of daily security operation.

About System Analysis and Design at UPI Study

System Analysis and Design (Computer Science 390) is a self-paced online course of 69 video lessons in 9 chapters, from the analyst's role and requirements to UML modeling, interface and database design, testing, maintenance and project management. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses Every course with PRO →

Compare: Software Engineering vs Systems Analysis

Why take it here

Why students take System Analysis and Design with UPI Study

From business problem to working systemSystem Analysis and Design teaches how analysts study a business need and turn it into a system design: requirements, UML and data-flow models, interface and database design, implementation and project management. It is a core course in information systems and IT degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

System Analysis and Design carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Security Management: Systems, Tools, and Applications

What is the CIA triad in information security?
The CIA triad is confidentiality, integrity, and availability, the three properties information security protects. Confidentiality means information is accessible only to those authorized to see it, and a data breach is a failure of it. Integrity means information is accurate and unaltered, which tampering with financial records violates. Availability means authorized users can reach systems when needed, which a denial-of-service attack disrupts.
What is the difference between an ISMS and ISO 27001?
An information security management system, or ISMS, is an organization's own ongoing system of policies, procedures, and controls for managing security risk, while ISO 27001 is the international standard that specifies requirements for an ISMS. Organizations can be formally certified against ISO 27001. An ISMS typically runs on the plan, do, check, act cycle of continuous improvement.
What is a secure SDLC?
A secure SDLC builds security into every phase of the life cycle rather than testing for it once at the end. Security requirements are identified in planning and documented in analysis. Design includes threat modeling. Implementation follows secure coding practices and uses static analysis to find vulnerabilities. Testing adds security tests such as penetration testing, and maintenance continues with patching, monitoring, and vulnerability management.
What do SIEM and IAM tools do?
A SIEM, or security information and event management tool, collects and correlates event and log data in real time and alerts on suspicious activity, such as unusual failed logins across several servers. An IAM, or identity and access management tool, controls who can access which systems by enforcing authentication and authorization, for example revoking a former employee's access when they leave.

About the System Analysis and Design course

How many college credits is System Analysis and Design?
System Analysis and Design (Computer Science 390) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does System Analysis and Design cost and what is included?
$250, paid once, with lifetime access: all 69 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. Students who want several courses choose UPI Study PRO instead.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does System Analysis and Design take?
It is self-paced with no deadlines. The 69 lessons total about 9 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in System Analysis and Design.

69 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in System Analysis and Design →Download the syllabusEvery course with PRO →
System Analysis and Design
3 credits · NCCRSEnroll →