Студопедия

КАТЕГОРИИ:


Архитектура-(3434)Астрономия-(809)Биология-(7483)Биотехнологии-(1457)Военное дело-(14632)Высокие технологии-(1363)География-(913)Геология-(1438)Государство-(451)Демография-(1065)Дом-(47672)Журналистика и СМИ-(912)Изобретательство-(14524)Иностранные языки-(4268)Информатика-(17799)Искусство-(1338)История-(13644)Компьютеры-(11121)Косметика-(55)Кулинария-(373)Культура-(8427)Лингвистика-(374)Литература-(1642)Маркетинг-(23702)Математика-(16968)Машиностроение-(1700)Медицина-(12668)Менеджмент-(24684)Механика-(15423)Науковедение-(506)Образование-(11852)Охрана труда-(3308)Педагогика-(5571)Полиграфия-(1312)Политика-(7869)Право-(5454)Приборостроение-(1369)Программирование-(2801)Производство-(97182)Промышленность-(8706)Психология-(18388)Религия-(3217)Связь-(10668)Сельское хозяйство-(299)Социология-(6455)Спорт-(42831)Строительство-(4793)Торговля-(5050)Транспорт-(2929)Туризм-(1568)Физика-(3942)Философия-(17015)Финансы-(26596)Химия-(22929)Экология-(12095)Экономика-(9961)Электроника-(8441)Электротехника-(4623)Энергетика-(12629)Юриспруденция-(1492)Ядерная техника-(1748)

Text 3a




TEXT 2C.

E-BUSINESS CALLS FOR A HOLISTIC SECURITY SOLUTION.

 

Although the word holistic may evoke images of acupuncture, meditation or yoga, it’s actually a very apt term for describing how enterprises should approach security as they progress along the e-business path. Holism asserts that a whole entity is more than just the sum of its parts. And that’s exactly what is required to establish an effective security solution. As a result, the interdependence of security technologies must be taken into consideration when companies move forward with e-business transformations.

One of the most important requirements of a holistic security solution is that it must be based on an integrated standards – based architecture. An open and flexible solution can substantially reduce the risk of undetected flaws compromising an entire security infrastructure. An effective solution must also minimize the risk of business data being lost and ensure that applications remain available, performing as designed.

The adequately reduce these risks, an effective security solution requires the following capabilities:

v Authorization: to allow only legitimate users access to systems, data applications or networks. You can ensure everyone follows the stipulated policy rules.

v Accountability: to determine who performed any given action and which actions occurred during a specific time interval. You can identify who did what, when.

v Assurance: to demonstrate and periodically validate the claimed level of security protection is being enforced. You can confirm the system carries out policy rules.

v Availability: to keep systems, data, networks and applications usable. You can ensure systems and network resources are available when needed.

v Administration: to define, maintain, monitor and modify policy information. You can customize and update the policy rules.

These capabilities must be based on corporate – wide policies that can provide protection for the entire set of networks, systems and applications installed in an enterprise.

 

UNIT 3.

NETWORK SECURITY.

 

I. The Network Security Challenge.

Network environments do tie together many components of the information system environments, are usually spread geographically rather than concentrated in one specific area and increase the population of employees involved in accessing the information assets. Therefore, they should come under more intense management scrutiny and exhibit higher degrees of control than simple batch processing environments. The ability to introduce errors into the processing of data, for example, increases with the introduction of every new terminal, link on the network or person who has access to the network. The opportunity for a dishonest or disgruntled employee to exploit the organization increases as the network grows. The chances for fire, water and natural disasters doing damage increase as the network extends across an organization’s sites. Physical protection of network components from theft and from hostile environments must be considered. Even the exposure to external attack by outsiders has to be addressed as the network expands.

II. Network Security Objectives.

Network security objectives can include: ensuring that the information transmitted from any point in a network is received at the destination it was intended to reach and nowhere else; ensuring that the information received at any point in a network is exactly the same in content as the data transmitted; ensuring that all components of the network on the organization’s premises are accessible only to employees with authorized access; ensuring that the sender of the information can verify that receipt was by (and only by) the authorized recipient; ensuring that the recipient of information can verify that the person from whom the communication appears to come is really the person who sent it;

ensuring that information, while in transit, cannot be observed, tampered with or extracted from the network by any unauthorized person or device; ensuring that any attempt to observe, tamper with or extract information from the network by an unauthorized person or device can be identified and that appropriate action can be taken to prevent future occurrences; ensuring that adequate alternate paths are available to transmit information from any point in a network to any other point to which the need for transmission of data exists; ensuring that an alternate means of communicating critical information has been identified, implemented and tested for the event that a failure of both the primary and backup paths should occur.

III. Network Controls and Procedures.

Security is a management issue, not a technological one. Therefore, management should recognize that the potential for loss in a network environment is greater than in any other, implement effective security measures and controls in advance of installing a network, and fine tune these controls as the network expands.

Implementing security controls in a network environment will have some associated costs. Therefore, prudent managers should: recognize and accept the need for information security; recognize that major sources of security exposure are from accidental or intentional but unauthorized events; define their network environment and major vulnerabilities; discern which controls should reduce risk in their environment; cost – justify implementing specific controls on the basis of risk reduction.

Although no two networks are identical in nature or scope there are some basic security controls which apply regardless of the simplicity or complexity of the network. These controls are categorized as follows: physical access controls, logical access controls, organizational controls, personnel controls, operational controls, application development controls, workstation controls, data transmission protection.

Words and word-combinations to memorize:

scrutiny-исследование, внимательное рассмотрение; batch processing environments-перечень условий обработки информации; natural disasters-бедствия, связанные с природными явлениями; premise-предпосылка; to tamper (with)-вмешиваться (во что-л.); primary path-главный (основной) путь; backup path-резервный (запасной) путь; fine tune-точная настройка; discern-распознавать; scope-область действия, сфера рассмотрения.

I. Answer the following questions:

1. Why should network environments come under more intense management scrutiny? 2. Why does the ability to introduce errors into the processing of data increase? 3. What can network security objectives include? 4. Is security a management issue or a technological one?

5. What can you say about the potential for loss in a network environment? 6. What should prudent managers recognize and undertake? 7. What are the basic security controls?

II. Translate the following sentences paying attention to the inverted word order.

1. Could I have this information, I would avoid this mistakes. 2. No longer is the processing of information carried out only in the computer’s central processing unit. 3. Network environments do tie together many components of the information system environment. 4. Responsibility for the business functions does lie with senior executives. 5. Personnel did face with new security related tasks which at first sight seem more trouble than they are worth. 6. Often do logical access controls play an important role in any information systems environment. 7. Had we know about these types of network services before, we would have acted differently.

III. Translate the following sentences paying attention to the meaning of SINCE, FOR.

1. Thus programming itself takes less time since fewer errors are made and residual errors are detected and corrected more rapidly. 2. First, since many elements of the computer can be working on different portions of the same tasks, the work may be done faster. 3. This may very well require additional training of personnel or the use of specially trained personnel, since system development skills are not a normal part of professional training. 4. Since 1952 the addition speed of computers has gone to more than 100000 additions per second. 5. This document has required anyone, including individuals, who develops, exports, imports and even uses any cryptography means, to obtain a license from Federal Agency for Governmental Communications and Information since president Boris Yeltsin signed a decree imposing strong limitations on the use of cryptography in Russia.

6. Researchers have been looking into biological models for computer antivirus systems for several years. 7. Some of this research is based on the similarities between human and computer viruses, for both types of viruses latch onto a host, use its resources to reproduce, and cause a range of symptoms.

8. The first thing for you to do is to understand the weak points of your system.

IV. Analyse and translate the following conditional sentences.

1. The best technical facilities are only effective, provided they are installed, implemented, and maintained with adequate administrative procedures. 2. A card entry access will not be effective, unless proper procedures have been established to control the issue granting of authority and retrieval of the entry cards. 3. If security products did not conform to open standards, real integration was extremely complicated to manage. 4. What effect would it have on your business, if you computer and data disappeared today? 5. If I were here tomorrow I would determine the level of security for your applications. 6. We would have acted differently, if we had known about these types of network services before. 7. Had this system provided encryption of data our clients would have used it.

 




Поделиться с друзьями:


Дата добавления: 2015-03-29; Просмотров: 506; Нарушение авторских прав?; Мы поможем в написании вашей работы!


Нам важно ваше мнение! Был ли полезен опубликованный материал? Да | Нет



studopedia.su - Студопедия (2013 - 2024) год. Все материалы представленные на сайте исключительно с целью ознакомления читателями и не преследуют коммерческих целей или нарушение авторских прав! Последнее добавление




Генерация страницы за: 0.012 сек.