David Kim - Fundamentals of Information Systems Security

World Headquarters
Jones & Bartlett Learning
25 Mall Road
Burlington, MA 01803
978-443-5000
www.jblearning.com

Jones & Bartlett Learning books and products are available through most bookstores and online booksellers. To contact Jones & Bartlett Learning directly, call 800-832-0034, fax 978-443-8000, or visit our website, www.jblearning.com.

Substantial discounts on bulk quantities of Jones & Bartlett Learning publications are available to corporations, professional associations, and other qualified organizations. For details and specific discount information, contact the special sales department at Jones & Bartlett Learning via the above contact information or send an email to .

Copyright 2023 by Jones & Bartlett Learning, LLC, an Ascend Learning Company

All rights reserved. No part of the material protected by this copyright may be reproduced or utilized in any form, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from the copyright owner.

The content, statements, views, and opinions herein are the sole expression of the respective authors and not that of Jones & Bartlett Learning, LLC. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not constitute or imply its endorsement or recommendation by Jones & Bartlett Learning, LLC and such reference shall not be used for advertising or product endorsement purposes. All trademarks displayed are the trademarks of the parties noted herein. Fundamentals of Information Systems Security, Fourth Edition is an independent publication and has not been authorized, sponsored, or otherwise approved by the owners of the trademarks or service marks referenced in this product.

There may be images in this book that feature models; these models do not necessarily endorse, represent, or participate in the activities represented in the images. Any screenshots in this product are for educational and instructive purposes only. Any individuals and scenarios featured in the case studies throughout this product may be real or fictitious but are used for instructional purposes only.

24458-8

Production Credits

Vice President, Product Management: Marisa R. Urbano

Vice President, Product Operations: Christine Emerton

Director, Content Management: Donna Gridley

Director, Project Management and Content Services: Karen Scott

Product Manager: Ned Hinman

Content Strategist: Melissa Duffy

Content Coordinator: Mark Restuccia

Development Editor: Kim Lindros

Technical Editor: Jeffrey Parker

Project Manager: Jessica deMartin

Senior Project Specialist: Jennifer Risden

Digital Project Specialist: Rachel DiMaggio

Marketing Manager: Suzy Balk

Product Fulfillment Manager: Wendy Kilborn

Composition: Straive

Cover Design: Briana Yates

Media Development Editor: Faith Brosnan

Rights Specialist: Benjamin Roy

Cover Image (Title Page, Front Matter Opener, Part Opener, Chapter Opener): Ornithopter/Shutterstock

Printing and Binding: McNaughton & Gunn

Library of Congress Cataloging-in-Publication Data

Names: Kim, David (Information technology security consultant) | Solomon, Michael (Michael G.), 1963 author.

Title: Fundamentals of information systems security / David Kim, Michael G. Solomon.

Description: Fourth edition. | Burlington, Massachusetts : Jones & Bartlett Learning, [2023] | Includes bibliographical references and index.

Identifiers: LCCN 2021021301 | ISBN 9781284220735 (paperback)

Subjects: LCSH: Computer security. | Computer networksSecurity measures. | Information storage and retrieval systemsSecurity measures.

Classification: LCC QA76.9.A25 K536 2023 | DDC 005.8dc23

LC record available at https://lccn.loc.gov

6048

Printed in the United States of America

252423222110987654321

This book is dedicated to our readers and students and the IT professionals pursuing a career in information systems security. May your passion for learning IT security help you protect the information assets of the United States of America, our businesses, and the private data of our citizens.

David Kim

To God, who has richly blessed me in so many ways.

Michael G. Solomon

Contents

Ornithopter/Shutterstock

Preface

Ornithopter/Shutterstock

Purpose of This Text

This text is part of the Information Systems Security & Assurance (ISSA) Series from Jones & Bartlett Learning ( www.issaseries.com ). Designed for courses and curriculums in IT Security, Cybersecurity, Information Assurance, and Information Systems Security, this series features a comprehensive, consistent treatment of the most current thinking and trends in this critical subject area. These titles deliver fundamental information security principles packed with real-world applications and examples. Authored by Certified Information Systems Security Professionals (CISSPs) and experienced cybersecurity consultants, this series delivers comprehensive information on all aspects of information security. Reviewed word for word by leading technical experts in the field, these texts are not just current but forward thinkingputting you in the position to solve the cybersecurity challenges not just of today but also of tomorrow.

of this text on information security fundamentals focuses on new risks, threats, and vulnerabilities associated with the transformation to a digital world and the Internet of Things (IoT). Individuals, students, educators, businesses, organizations, and governments have changed how they communicate, share personal information and media, and do business. Led by the vision of the IoT, the Internet and broadband communications have entered into our everyday lives. This digital revolution has created a need for information systems security. With recent compliance laws requiring organizations to protect and secure private data and reduce liability, information systems security has never been more recognized than it is now.

is adapted from CompTIAs Security+ professional certification. CompTIAs Security+ is the most widely accepted foundational, vendor-neutral IT security knowledge and skills professional certification. As a benchmark for foundational knowledge and best practices in IT security, the Security+ professional certification includes the essential principles for network security, operational security, and compliance. Also covering application, data, and host security, threats and vulnerabilities, access control, identity management, and cryptography, the Security+ certification provides a solid foundation for an IT security career.

of this text provides a resource for readers and students desiring more information on information security standards, education, professional certifications, and recent compliance laws. These resources are ideal for students and individuals desiring additional information about educational and career opportunities in information systems security.