11

ASSESSING THE NEED FOR SECURITY

Chapter 1

Chapter 1: Assessing the Need for Security 2

ASSESSING THE NEED FOR SECURITY

Security design concepts

Assets

Threats

Vulnerabilities

Countermeasures

Historical compromises

Chapter 1: Assessing the Need for Security 3

SECURITY DESIGN INFLUENCES

Legal requirements

Business risk tolerance

Finance

Current events

Technology

Chapter 1: Assessing the Need for Security 4

THE THREE PILLARS OF INFORMATION SECURITY

Confidentiality

Integrity

Availability

Chapter 1: Assessing the Need for Security 5

DEFENSE-IN-DEPTH

Use multiple layers of defense. For example: Security guards and security cameras

Network firewalls and host-based firewalls

Log on as a non-administrator and use antivirus software

Protects against any single vulnerability

Gives you time to test critical updates

Chapter 1: Assessing the Need for Security 6

THE SCOPE OF SECURITY

Security architecture

Physical security

Cryptography

Access control

Network security

Chapter 1: Assessing the Need for Security 7

THE SCOPE OF SECURITY (CONT.)

Applications and systems development

Operations security

Security management practices

Law, investigations, and ethics

Business continuity planning

Chapter 1: Assessing the Need for Security 8

ATTACK COMPONENTS

Asset

Threat agent

Threat

Vulnerability

Compromise

Countermeasure

Chapter 1: Assessing the Need for Security 9

ASSET

Items that you have purchased: Software

Hardware

Facilities

People

Information

Anything else deserving protection

Chapter 1: Assessing the Need for Security 10

THREAT AGENT

The attacker: Malicious attackers

Nonmalicious attackers

Mechanical failures

Catastrophic events

Chapter 1: Assessing the Need for Security 11

THREAT AGENT: MALICIOUS ATTACKERS

The classic hacker attacking from outside

Disgruntled employees attacking from inside

Likely to have specific goals and objectives

To anticipate their attacks, study their motivations

Chapter 1: Assessing the Need for Security 12

THREAT AGENT: NONMALICIOUS ATTACKERS

People make mistakes that can cause damage such as invalid data or failed services

Examples: programming bugs, data-entry errors

Mitigate with: Thorough testing procedures

Backups

Business continuity plans

Chapter 1: Assessing the Need for Security 13

THREAT AGENT: MECHANICAL FAILURES

Power outages, hardware failures, network outages

Mitigate with: Business continuity plans

Network redundancy

Server clustering

Service level guarantees

Chapter 1: Assessing the Need for Security 14

THREAT AGENT: CATASTROPHIC EVENTS

Extreme weather: tornadoes, hurricanes, earthquakes, tsunami

Fire

Acts of war

Catastrophic events are rare, but the damage is tremendous. Therefore, the total risk is often high.

Chapter 1: Assessing the Need for Security 15

THREAT

Threat agent is the attacker, threat is the attack

Use STRIDE to remember the six main types of threat: Spoofing identity Tampering with data Repudiation Information disclosure Denial-of-service Elevation of Privilege

Chapter 1: Assessing the Need for Security 16

VULNERABILITY

Also known as a weakness Has the potential to be a compromise when

combined with a threat Common vulnerability types:

Physical Natural Hardware and software Media Communications Human

Chapter 1: Assessing the Need for Security 17

COMPROMISE

A successful attack, often called an exploit

Occurs when a threat agent creates a threat for an unprotected vulnerability

If the threat does not penetrate your defenses, you were merely attacked. Attacks are not a problem; compromises are a problem.

Chapter 1: Assessing the Need for Security 18

COUNTERMEASURE

Also known as a safeguard

Reduce the likelihood of a vulnerability

Does not eliminate a vulnerability

Three main types: Preventative

Detective

Reactive

Chapter 1: Assessing the Need for Security 19

PREVENTATIVE COUNTERMEASURES

Prevent threats from exploiting a vulnerability

Examples: Firewalls

Software updates

Antivirus software

Employee security training

Chapter 1: Assessing the Need for Security 20

DETECTIVE COUNTERMEASURES

Used to detect an attack or a compromise

Can enable you to respond after an attack begins, but before a compromise occurs

Can also be used to detect a successful attack

Examples: Intrusion-detection system

Security logs

Chapter 1: Assessing the Need for Security 21

REACTIVE COUNTERMEASURES

Used after a compromise

Examples: On-site or off-site backups

Disaster recovery plans

Law enforcement

Chapter 1: Assessing the Need for Security 22

ATTACK COMPONENTS

Chapter 1: Assessing the Need for Security 23

HISTORICAL COMPROMISES

The fundamentals of security design remain constant throughout history

A Windows network will be subject to the same types of attack that were used before computers even existed

“Those who cannot learn from history are doomed to repeat it”

Chapter 1: Assessing the Need for Security 24

1938: POLES BREAK NAZI ENCRYPTION

Nazis use encryption to communicate privately over public radio communications

Poles spend many years studying the communications

Poles break the encryption because of Nazi mistakes

Lesson: Humans make mistakes

Chapter 1: Assessing the Need for Security 25

1972: CAP’N CRUNCH CRACKS PHONE SYSTEM

Blind children discover that a whistle in a Cap’n Crunch cereal box makes a 2600-hertz (Hz) tone also used by telephone equipment

Blow the whistle and get free long-distance calls

Telephone company’s services are stolen, but catch John Draper (a threat agent) by monitoring usage logs

Lesson: Do not rely on security by obscurity and use detective countermeasures

Chapter 1: Assessing the Need for Security 26

1988: MITNICK STEALS CODE FROM DEC

Kevin Mitnick uses social engineering to gain access to user credentials

Abuses credentials to access internal network

FBI monitors, arrests, and convicts Mitnick of multiple computer crimes

Lesson: Sophisticated attackers use unconventional attacks

Chapter 1: Assessing the Need for Security 27

2000: ATTACKER STEALS MICROSOFT SOURCE CODE

Microsoft employee runs Trojan horse received in e-mail

Trojan horse opens a back door that contacts threat agents

Threat agents use access to collect passwords and steal source code

Damage limited because credentials gave threat agents access to limited portions of the source code

Microsoft’s tarnished security reputation caused immeasurable damage

Lesson: Valuable data deserves expensive countermeasures

Chapter 1: Assessing the Need for Security 28

SUMMARY

Technology is the least important of the influences to security design

Important assets deserve multiple layers of protection

Understand the components of an attack

Learn from the mistakes of other security designers