Powtoon - Information Security

Embed code

Select a size, the embed code changes based on your selection.

_abc Powtoon Transcript

Information Security

506 Technology Application In Information organization

Prof.Charlene L. Al-Qallaf
Prepared By: Bibi Hussainy
Dec 4,2024

What is Information Security? 
Information Security, or InfoSec, involves protecting digital and physical information assets from unauthorized access, misuse, alteration, and destruction.

Key Objectives:
Confidentiality:
Ensuring data is accessible only to authorized individuals.
Integrity: 
Protecting data from tampering to ensure accuracy.
Availability: 
Guaranteeing information is available when needed.

01 Introduction to Information Security 
1
Library Relevance:
Libraries store personal user data, loan histories, and sometimes financial details. A secure environment ensures the confidentiality and trust of patrons.

Example:
In 2022, a regional library in Canada suffered a data breach exposing the borrowing history of over 5,000 users. Enhanced encryption methods were later implemented to prevent further issues.  Smith (2021); ISO Standards (2023).

2
02  Scope of Information Security
Broad Applications: Information Security spans various domains:

Data Security: Ensures information (digital or physical) remains protected.

Network Security: Safeguards computer networks from intrusion or misuse.

Application Security: Secures software applications during development and operations.

Physical Security: Limits access to physical systems housing sensitive data.

3
Library Relevance:
Libraries must apply InfoSec principles across databases, catalogs, and public-facing services like kiosks.

Example:
The American Library Association (ALA) conducted a study in 2021 showing that 60% of libraries had unencrypted wireless networks, which posed significant risks. Following this, many libraries updated to WPA3 standards. Smith (2021); ALA Guidelines (2023).

4
Public-Facing Services like kiosks in Libraries
Kiosk is a stand-alone booth that can be built and utilized for various purposes in high-traffic areas such as malls, airports, and train stations.
5
WPA3 standards
6
03     The CIA Triad - Core Principles of 
Information Security
03     The CIA Triad - Core Principles of Information Security

Library Example:
User logins for accessing online library accounts are encrypted to prevent unauthorized access.
Definition: 
Restricting access to sensitive information to authorized individuals.
Techniques:
Encryption (e.g., SSL/TLS for websites).Access control mechanisms like passwords and biometrics.
Confidentiality:
7
8
Secure Sockets Layer (SSL):
 is a communication protocol, or set of rules, that creates a secure connection between two devices or applications on a network. 
Transport Layer Security (TLS) :
is the upgraded version of SSL that fixes existing SSL vulnerabilities. TLS authenticates 
more efficiently and continues to support encrypted communication channels.
2. Integrity:
Definition:
 Ensuring that data remains unchanged and trustworthy.
Techniques:
Use of hashing algorithms to verify data authenticity.Digital signatures to detect tampering.
03     The CIA Triad - Core Principles of Information Security
9
10
Hashing algorithms :
Mathematical functions that map any input to a fixed-length output, called a hash or digest. Hashing is used to:
Encrypt and decrypt digital signaturesEnable rapid data retrievalUniquely identify a specific object from a group of similar objects
Digital signatures
A way to verify the authenticity and integrity of a message or document using a pair of keys:
Private key: Only known by the signer
Public key: Anyone can use to verify the signature

Library Example:
Library archives use checksum verification to maintain the integrity of digital collections.

11
Checksum verification: 
It is a process that uses a checksum to verify that a file or app has not been modified or tampered with. Checksums are values that are generated from data before and after it is transmitted, and are used to detect corruption.
3. Availability:
Definition: 
Ensuring information and resources are accessible when needed.
Techniques:
Disaster recovery plans for system failures.Redundant network connections to minimize downtime.
03     The CIA Triad - Core Principles of Information Security
12

Library Example:
Cloud backups ensure 
e-books remain accessible even during server outages. Smith (2021); ISO Standards (2023).

13
04 Historical Perspective of 
Information Security in Libraries
Evolution of Security Practices:
Pre-Digital Era:
Restricted reading rooms and physical locks.Limited access to rare or valuable materials.

Early Digital Era:
Basic password systems for access control.Development of Integrated Library Systems (ILS). An Integrated Library System (ILS) is a software system that helps manage a library's resources and functions. ILSs are also known as library management systems (LMS). 
Modern Era:
Advanced tools like firewalls, encryption, and AI for real-time threat detection.Adoption of zero-trust architectures to mitigate insider threats.
Example:
In the 1990s, libraries began adopting MARC (Machine-Readable Cataloging) standards to digitize catalogs. This required new security measures to protect the growing databases from cyber threats.   Smith (2021); ALA Guidelines (2023).

14
05 Emerging Trends in Information Security

New Developments:

Zero-Trust Architecture: Requires verification for all network access, even from within the organization.
2. AI in Cybersecurity: 
AI tools analyze network traffic to detect anomalies and potential breaches.

3. Privacy-Enhancing Technologies: 
Differential privacy techniques 
protect user data during analysis without revealing identifiable information.
15
Library Relevance:
Libraries are implementing AI tools to detect abnormal login patterns and prevent account compromises.

Example:
The National Library of Singapore deployed AI-driven threat monitoring in 2022, reducing successful intrusion attempts by 35%.   Cybersecurity News (2023).
16
17
06   IS MANAGEMENT
Privacy:
Privacy in information security means ensuring that user data and interactions remain confidential and protected from unauthorized access or misuse.
Importance in Libraries:
Anonymizing borrowing histories.Ensuring that inter-library loan transactions are encrypted.Avoiding profiling by external entities.
Techniques for Protecting Privacy:
Implementing access controls for sensitive data.Data anonymization for analytics.Secure deletion protocols.(It is a process of overwriting the data to completely destroy all remnants of digital data on a storage device.)
 Example:
Libraries complying with GDPR anonymize user activity logs after a specified retention period.   Smith (2021); GDPR Guidelines (2023).
18
19
07 Regulations and 
Policies
Key Global Regulations:
General Data Protection Regulation (GDPR): 
Governs user data privacy in the EU.

Health Insurance Portability and Accountability Act (HIPAA): Protects health-related data.

Family Educational Rights and Privacy Act (FERPA): 
Ensures the security of student educational records.

Library-Specific Policies:
Staff access limited to roles (e.g., only administrators manage system credentials).Periodic audits to ensure compliance.

Example:
Libraries conducting health workshops must follow HIPAA when storing health-related user information.   Smith (2021); ISO Standards (2023).
20
08 Library Application Security
Core Aspects:
Encrypted Access: 
Secure library systems (e.g., OPAC) via HTTPS protocols.

Authentication: 
Use multifactor authentication for administrative logins.

Regular Security Audits: 
Identify and patch vulnerabilities in systems like Integrated Library Systems (ILS).

Example:
The British Library introduced IP-restricted administrative logins for its ILS, reducing the risk of unauthorized access. Smith (2021).
21
22
09 THREATS

Hacking and Password Cracking
Hacking: Exploiting vulnerabilities to gain unauthorized access.
Example: A hacker accessed an unsecured library database, exposing patron information.

Password Cracking: Using automated tools to guess weak passwords.
Example: A brute-force attack compromised staff accounts with weak credentials.

Prevention:
Regular password updates.Encouraging complex passwords and two-factor authentication. Smith (2021); Cybersecurity Trends (2023).
23
24
10. Social Engineering and Phishing
Social Engineering: 
Tricking individuals into divulging confidential information.

Techniques: 
Impersonation, fake technical support calls.

Phishing: 
Fraudulent emails or messages prompting users to share credentials.
Example: 
Library patrons received fake overdue notices containing malicious links.
Prevention:
Regular training sessions for staff.Multi-layered authentication for sensitive systems. Smith (2021).
CALL US 
25
Malware 
11. Personal Stories : Facing Hacking Challenges 
26
27
28
29
12. Web and 
Wireless Threats
30
Web Threats:
Spoofing: 
Impersonating trusted entities.

Spoofing is the act of disguising a communication from an unknown source as being from a known, trusted source. 
Spoofing can apply to emails, phone calls, and websites, or can be more technical, such as a computer spoofing an IP address, Address Resolution Protocol (ARP), or Domain Name System (DNS) server.
Website Vulnerabilities: 
Exploiting flaws like SQL injection. 
Some common website vulnerabilities include:
Cross-site scripting (XSS): A code injection attack that sends malicious code to a user's browser. Security misconfiguration: A lack of maintenance or attention to the web application configuration. Broken access control: A vulnerability that allows a user to interact with data in a way they shouldn't.

Wireless Threats:
Public Wi-Fi in libraries can be exploited for eavesdropping or man-in-the-middle attacks.

Preventive Measures:
Enforcing WPA3 encryption for Wi-Fi.Conducting periodic penetration testing of websites.   Smith (2021).
31
32
13. PERSONAL COMPUTER SECURITY
Personal computer security, also known as cybersecurity, is the practice of protecting your computer systems, networks, and data from threats like viruses, hacking, and identity theft. It's important to protect your personal computer because so much of your personal and professional life takes place online.  
Updates and Patches
Importance:
Ensures vulnerabilities in software are fixed promptly.Reduces the risk of zero-day attacks.
Library Application:
Keeping all systems, including public-use computers, updated.
 Example:
Libraries using auto-update settings to ensure antivirus definitions remain current.
  Smith (2021).

33
14. Secure Communications
Techniques:
HTTPS: HTTPS is hyper-text-transfer-protocol
Encrypts user sessions on websites.
VPN: 
Virtual Private Networks or VPNs secures remote staff access.
A VPN encrypts your data and routes your traffic through a server owned by a central service provider. VPNs are generally faster than TOR and offer more features, but they can be paid services and some store logs.
TOR: 
The Onion Routers (TOR) ensures user anonymity.
Short for "The Onion Router", Tor is a free, open-source browser that uses a decentralized network of volunteer-run servers to encrypt your data three times and route it through three random nodes. Tor is good for anonymity.  
Library Application:
VPNs allow staff to securely access library management systems while working remotely. Smith (2021).
34
15.File and Password Security
Unix File Permissions:
Read, Write, Execute permissions for users and groups.

Password Management:
Use of password managers like LastPass for secure credential storage.

Library Application:
Controlling file access permissions for library archives.
  Smith (2021).

35
16. NETWORK SECURITY
Network security is a set of technologies, policies, and procedures that protect a network's infrastructure, devices, users, and applications from unauthorized access, misuse, or theft. It also secures traffic and assets that are accessible through the network.
Firewalls and Proxy Servers
Firewalls: Monitor and block unauthorized access to networks.
Proxy Servers: Intermediaries that anonymize user activity and improve security.
Library Application:
Proxy servers like EZproxy help libraries secure remote access to resources.
Smith (2021); Anderson (2023).

36
37
17. Authentication Methods
An authentication method is a process or technique that verifies a user's or device's identity before granting access to a service.

Techniques:
Single Sign-On (SSO): Simplifies access with one set of login credentials.Biometric Authentication: Using Fingerprints or facial recognition to verify identity.Multifactor Authentication (MFA): Combines multiple layers like passwords and OTPs to enhance security.
Library Example:
Implementing MFA for administrative access to sensitive library systems. Smith (2021).
38
39
Recent Case Study
Recent Case Study
40
Title: Implementing Zero-Trust Architecture in Academic Libraries

Background: XYZ University Library, serving over 200,000 users, faced increasing cybersecurity threats, including phishing attacks and brute force attempts targeting user accounts.

Solution: The library adopted a Zero-Trust Architecture, requiring constant verification for all users and devices. 
Key measures included:
Multi-Factor Authentication (MFA): Combining passwords with OTPs and biometric checks for staff.

Network Segmentation: 
Separating public and internal systems, limiting access to sensitive databases.
AI-Based Monitoring: Detecting and blocking unusual activities like repeated failed logins or access from unapproved locations.

Outcome: Within six months, unauthorized login attempts dropped by 60%, and the library reported zero successful phishing attacks. Staff and user confidence in the system improved significantly, enhancing trust and operational reliability. 
Cybersecurity News (2023).

41
Thank You for Listening 
Q and A
Quizizz and jigsawplanet websites  were utilized as assessment tools to evaluate students understanding following the presentation 
(Multi-Choice Qustions and Puzzle)
REFERENCES
1.  American Library Association (ALA).  (2023).  Guidelines for library cybersecurity . Retrieved from [https://www.ala.org](https://www.ala.org)

2. Anderson, B. (2023).  The evolving threat landscape for libraries .  Library Security Journal, 15 (2), 134-148.

3. Anderson, M. (2023).  Information security practices for libraries . Tech Publishing House.

4.  Cybersecurity News.  (2023). Zero-trust architecture in academic libraries: A case study. Retrieved from [https://www.cybersecuritynews.com](https://www.cybersecuritynews.com)

5.  General Data Protection Regulation (GDPR) Guidelines.  (2023). General data protection regulation compliance in libraries. Retrieved from [https://www.eugdpr.org](https://www.eugdpr.org)

REFERENCES
6.  ISO Standards.  (2023).  ISO/IEC 27001: Information security management standards . Retrieved from [https://www.iso.org](https://www.iso.org)

7. Research on cybersecurity and library information systems (2023).

8. Microsoft Security Reports. (2023). Ensuring secure public library systems with regular updates. Retrieved from [https://www.microsoft.com/security](https://www.microsoft.com/security)

9. Pew Research Center. (2023).  Cyber threats and public access systems: Libraries under attack . Retrieved from [https://www.pewresearch.org](https://www.pewresearch.org)

10. Smith, J. M. (2021).  Information Technology for Librarians and Information Professionals . Rowman & Littlefield Publishers.

Information Security

Copy this link to share with friends and colleagues:

WELCOME TO POWTOON!