Information Systems — Countermeasures, Threats, Infection/Detection/Reaction
Information System Definition
IS Definition
An information system is a discrete set of information resources organized for:
- Collection of information
- Processing of information
- Maintenance of information
- Use of information
- Sharing of information
- Dissemination of information
- Disposition of information
Specialized Systems Included
Specialized Systems Included
Information systems also include specialized systems, such as:
- Industrial/process controls
- Telephone switching and private branch systems
- Environmental controls
User Protection Responsibilities
User Protection Foundation
All authorized users must protect information systems against:
- Tampering
- Theft
- Loss
Three Protection Methods
3 Protection Methods
Protection occurs by:
- Controlling physical access to facilities and data
- Ensuring user access to information system resources is based upon a favorable background investigation, security clearance, and need to know (for classified)
- Ensuring protection of applicable unclassified, sensitive, and classified information through encryption, according to the applicable Federal Information Processing Standard (FIPS) Publication 140-2, *Security Requirements for Cryptographic Modules*
Countermeasures
Countermeasure Definition
A countermeasure is any action, device, procedure, or technique that meets or opposes (counters) a threat, vulnerability, or attack by:
- Eliminating damage
- Preventing damage
- Minimizing damage
- Or by discovering and reporting the event so corrective action can be taken
Threats
Threats Foundation
EVERY USAF information system has vulnerabilities and is susceptible to exploitation.
Threat Definition
IS Threat Definition
Threats to information systems include, but are not limited to, any circumstance or event with the potential to adversely impact any operation or function through an information system via:
- Unauthorized access
- Destruction
- Disclosure
- Modification of information
- Or denial of service
Three Steps for Protection
3 IS Protection Steps
There are three steps involved in protecting information systems from viruses and other forms of malicious logic:
- Infection
- Detection
- Reaction
3 Steps Combination
These steps include a combination of human and technological countermeasures to ensure the protection is maintained throughout the lifecycle of the information system.
Infection
Infection Definition
Infection is the invasion of information system applications, processes, or services by a virus or malware code causing the information system to malfunction.
Detection
Detection Definition
Detection is a signature or behavior-based antivirus system that signals when an anomaly caused by a virus or malware occurs.
Reaction
Reaction Definition
When notified of a virus or malware detection, react by:
- Immediately notifying your information system security officer
- Following local procedures