Question 2: What is information security? Information security refers to the protection of information systems (including hardware, software, data, personnel, physical environment and its infrastructure) from being damaged, changed or leaked by accidents or malicious reasons, the system runs continuously and reliably, and the information service is uninterrupted, so as to finally realize business continuity. Information security mainly includes the following five aspects: the need to ensure confidentiality, authenticity, integrity, unauthorized copying and the security of parasitic systems.
Question 3: What does information security mean? Information security means that the hardware and software of the information network and the data in its system are protected from being destroyed, changed or leaked by accidents or malicious reasons, and the system runs continuously, reliably and normally without interrupting information services.
Information security is a comprehensive subject involving computer science, network technology, communication technology, cryptography technology, information security technology, applied mathematics, number theory, information theory and other disciplines.
Broadly speaking, all technologies and theories related to the confidentiality, integrity, availability, authenticity and controllability of information on the network are the research fields of network security.
The realization goal of information security
Authenticity: judge the source of information and identify the information from forged sources.
◆ Confidentiality: ensure that confidential information is not eavesdropped, otherwise eavesdroppers cannot understand the true meaning of the information.
◆ Integrity: ensure the consistency of data and prevent data from being tampered with by illegal users.
Availability: Ensure that legitimate users' use of information and resources will not be improperly denied.
Undeniability: It is extremely important to establish an effective responsibility mechanism to prevent users from denying their actions.
Controllability: the ability to control the dissemination and content of information.
Checkability: provides the basis and means for investigating emerging network security issues.
Major information security threats
◆ Stealing: Illegal users obtain sensitive information through data eavesdropping.
◆ Interception: Illegal users first obtain information and then send it to the real receiver.
◆ Forgery: Send forged information to the receiver.
◆ Tampering: Illegal users modify the communication information between legal users and then send it to the receiver.
Denial of service attack: attacks the service system, paralyzing the system and preventing legitimate users from obtaining services.
◆ Behavior Denial: Legal users deny the behavior that has happened.
◆ Unauthorized access: unauthorized use of network or computer resources by the system.
Spreading viruses: Spreading computer viruses through the network is very destructive, and it is difficult for users to guard against it.
The main source of information security threats
◆ Natural disasters and accidents;
◆ Computer crime;
◆ Human error, such as improper use and poor safety awareness;
◆ Hacking attack;
◆ Internal leakage;
◆ External leakage;
◆ Information loss;
Electronic espionage, such as information flow analysis, information theft, etc. ;
◆ Information warfare;
◆ Defects of network protocol itself, such as security issues of TCP/IP protocol.
Information security strategy
Information security policy refers to the rules that must be followed to ensure a certain degree of security protection. Realizing information security depends not only on advanced technology, but also on strict security management, legal constraints and security education;
Advanced information security technology is the fundamental guarantee of network security. Users assess the threats they face, decide the types of security services they need, choose the corresponding security mechanisms, and then integrate advanced security technologies to form an all-round security system;
◆ Strict safety management. All computer network users, enterprises and units should establish corresponding network security management measures, strengthen internal management, establish an appropriate network security management system, strengthen user management and authorization management, establish a security audit and tracking system, and improve the overall network security awareness;
◆ Formulate strict laws and regulations. Computer network is a new thing. Many of its behaviors can't be followed and there is no chapter to follow, which leads to the disorder of computer crimes on the network. In the face of increasingly serious cyber crimes, it is necessary to establish laws and regulations related to cyber security, so that criminals are intimidated by the law and dare not act rashly.
Main problems involved in information security
◆ Network attack and attack detection and prevention.
◆ Security vulnerabilities and security countermeasures
◆ Information security and confidentiality issues
◆ Internal security of the system.
◆ Anti-virus problem
◆ Data backup and recovery issues and disaster recovery issues.
Brief introduction of information security technology
At present, there are several kinds of safety products that are popular in the market and can represent the future development direction:
◆ Firewall: A firewall can be said to be an access control product in a sense. It sets up a barrier between the internal network and the unsafe external network to prevent ... >; & gt
Question 4: What is information security? Information security itself covers a wide range. It is as big as national military and political secrets, and as small as preventing the secrets of commercial enterprises from leaking, preventing teenagers from browsing bad information and revealing personal information. The information security system under the network environment is the key to ensure information security, including computer security operating system, various security protocols, security mechanisms (digital signature, information authentication, data encryption, etc. ), even the security system, any one of which may threaten global security. Information security service should at least include the basic theory supporting information network security service and the network security service architecture based on the new generation information network architecture.
Question 5: What is the purpose and content of information security? The purpose of information security is to protect information from all kinds of threats, so as to ensure business continuity, minimize business risks and maximize investment returns and business opportunities.
Information security mainly includes the following five aspects: the need to ensure confidentiality, authenticity, integrity, unauthorized copying and the security of parasitic systems. Information security itself contains a wide range, including how to prevent the disclosure of secrets of commercial enterprises, prevent teenagers from browsing bad information, and disclose personal information. The information security system under the network environment is the key to ensure information security, including computer security operating system, various security protocols, security mechanisms (digital signature, message authentication, data encryption, etc. ), and even security systems, such as UniNAC and DLP. As long as there are security loopholes, global security may be threatened.
Question 6: What is information security? Information security means that the hardware and software of the information network and the data in its system are protected from being destroyed, changed or leaked by accidents or malicious reasons, and the system runs continuously, reliably and normally without interrupting information services. Information security is a comprehensive subject involving computer science, network technology, communication technology, cryptography technology, information security technology, applied mathematics, number theory, information theory and other disciplines. Broadly speaking, all technologies and theories related to the confidentiality, integrity, availability, authenticity and controllability of information on the network are the research fields of network security. The goal of information security ◆ Authenticity: judge the source of information and identify the information from forged sources. ◆ Confidentiality: ensure that confidential information is not eavesdropped, otherwise eavesdroppers cannot understand the true meaning of the information. ◆ Integrity: ensure the consistency of data and prevent data from being tampered with by illegal users. Availability: Ensure that legitimate users' use of information and resources will not be improperly denied. Undeniability: It is extremely important to establish an effective responsibility mechanism to prevent users from denying their actions. Controllability: the ability to control the dissemination and content of information. Checkability: provides the basis and means for investigating emerging network security issues. The main information security threat ◆ Stealing: Illegal users obtain sensitive information through data eavesdropping. ◆ Interception: Illegal users first obtain information and then send it to the real receiver. ◆ Forgery: Send forged information to the receiver. ◆ Tampering: Illegal users modify the communication information between legal users and then send it to the receiver. Denial of service attack: attacks the service system, paralyzing the system and preventing legitimate users from obtaining services. ◆ Behavior Denial: Legal users deny the behavior that has happened. ◆ Unauthorized access: unauthorized use of network or computer resources by the system. Spreading viruses: Spreading computer viruses through the network is very destructive, and it is difficult for users to guard against it. The main sources of information security threats ◆ Natural disasters and accidents; ◆ Computer crime; ◆ Human error, such as improper use and poor safety awareness; ◆ Hacking attack; ◆ Internal leakage; ◆ External leakage; ◆ Information loss; Electronic espionage, such as information flow analysis, information theft, etc. ; ◆ Information warfare; ◆ Defects of network protocol itself, such as security issues of TCP/IP protocol. Information security policy Information security policy refers to the rules that must be observed in order to ensure a certain degree of security protection. Realizing information security depends not only on advanced technology, but also on strict security management, legal constraints and security education: ◆ Advanced information security technology is the fundamental guarantee of network security. Users assess the threats they face, decide the types of security services they need, choose the corresponding security mechanisms, and then integrate advanced security technologies to form an all-round security system; ◆ Strict safety management. All computer network users, enterprises and units should establish corresponding network security management measures, strengthen internal management, establish an appropriate network security management system, strengthen user management and authorization management, establish a security audit and tracking system, and improve the overall network security awareness; ◆ Formulate strict laws and regulations. Computer network is a new thing. Many of its behaviors can't be followed and there is no chapter to follow, which leads to the disorder of computer crimes on the network. In the face of increasingly serious cyber crimes, it is necessary to establish laws and regulations related to cyber security, so that criminals are intimidated by the law and dare not act rashly. The main problems involved in information security ◆ Network attacks and attack detection and prevention ◆ Security vulnerabilities and security countermeasures ◆ Information security and confidentiality ◆ System internal security and prevention ◆ Anti-virus ◆ Data backup and recovery, disaster recovery. Introduction to information security technology There are the following types of security products that are popular in the market and can represent the future development direction: ◆ Firewall: In a sense, firewall can be said to be an access control product. It sets up a barrier between the internal network and the unsafe external network to prevent illegal access to internal resources from the outside and unsafe access from the inside to the outside. The main technologies are packet filtering technology, application gateway technology and proxy service technology. Firewall can effectively prevent hackers from using unsafe services to attack internal networks, and achieve ... >; & gt
Question 7: What does a network information security officer do? 1. What is the qualification of "Registered Information Security Officer"?
"Certified Information Security Officer" (CISM) qualification refers to the personnel engaged in information security work in information security enterprises, information security consulting services, information security evaluation and certification institutions (including authorized evaluation institutions), social organizations, organizations, universities and technical departments (including standardization departments) related to the construction, operation and application management of information systems (networks) in enterprises and institutions. Obtaining this registration qualification shows that they have the qualification and ability of information security officers, and passed the evaluation and certification of information security products in China.
Second, the scope of CISM qualification registration
? CISM qualification registration is applicable to the following persons:
L network security technician
L IT or security consultant
L IT or security management personnel
Information technology auditor
L college students
People who have studied and studied information security technology.
L Information workers in institutions, enterprises and institutions
Three. CISM knowledge system
The knowledge system of "Certified Information Security Officer" covers the fields of information security guarantee foundation, information security technology, information security management, information security engineering and information security standards and regulations. "Registered Information Security Officer" training will provide students with comprehensive, systematic and professional basic knowledge and skills learning; In the technical field, students will be able to master and improve the knowledge and ability of operating system security, firewall, anti-virus, intrusion detection, password technology and application; In the field of management, students will be able to understand the basic knowledge of information security management and governance, and learn and establish the relevant knowledge and practical ability required by national policy requirements, risk assessment, disaster recovery and emergency response; In the field of engineering, students will be able to learn and understand the practice and experience of information security engineering management, consultation and supervision; In the field of standards and laws and regulations, students will be able to fully understand the laws and regulations related to national information security, as well as the standards and practical experience related to information security at home and abroad.
Question 8: What is information security? Computer and information science: electronic information science and technology, electronic information technology, information security. ......
Question 9: Information security includes data security, physical security, network security, host (system) security, application security and data security.
Question 10: What is the information security management system? Information security management system is a system in which an organization establishes information security policies and objectives in the whole or in a specific scope, and the methods adopted to achieve these objectives. It is the result of direct management activities, which is manifested as the sum of principles, objectives, methods, processes, lists and other elements.
Information security management system (ISMS) is a new concept in the field of information security developed from Britain around 1998, and it is the application of the ideas and methods of management system (MS) in the field of information security. In recent years, with the revision of ISMS international standards, ISMS has been quickly accepted and recognized around the world, and has become an effective method for organizations of all types and sizes to solve information security problems. ISMS certification has become an effective way for organizations to prove their information security level and ability to the society and its related parties.
Information security management system is a working system in which organizations and units formulate information security management policies and strategies according to the requirements of relevant standards of information security management system, adopt risk management methods to plan, implement, review and check information security management, and improve its implementation. The information security management system is established according to the ISO/IEC 2700 1 standard "Information technology security technology information security management system requirements", which is developed from BS7799-2 standard.
ISMS is a standard for establishing and maintaining an information security management system, which requires organizations to establish an information security management system by determining the scope of the information security management system, formulating information security policies, defining management responsibilities, and selecting control objectives and control methods based on risk assessment. Once the system is established, the organization shall operate according to the requirements specified in the system to maintain the effectiveness of the system operation; The information security management system should form a certain document, that is, the organization should establish and maintain a documented information security management system, which should explain the protected assets, organizational risk management methods, control objectives and methods, and the required degree of protection.